CosmWasm Runtime Capability Bypass Vulnerability Allowing Unauthorized Blockchain Actions

A vulnerability in CosmWasm prior to version 2.2.0 allows attackers to bypass capability restrictions in blockchains. This is achieved by exploiting a lack of runtime capability validation, which enables the deployment of contracts without proper capability enforcement. As a result, unauthorized actions can be executed on the blockchain.

Impact

Exploitation of this vulnerability could lead to unauthorized actions being performed on the blockchain, potentially allowing for malicious contract deployment and execution of actions that bypass normal capability restrictions.