Cosmos Labs faces backlash over disclosure of bug affecting four blockchains

Cosmos Labs disclosed a bug in its Cosmos EVM module that appeared to affect four blockchains. MANTRA used the module. TAC used the module. KiiChain used the module. Nesa used the module. Cosmos Labs quietly patched the bug last week. Cosmos Labs later warned validators on affected networks to halt their chains. Cosmos' silent patch model was criticized as negligent. The release notes called the fixes important and recommended a coordinated upgrade. Cosmos Labs did not post a warning on its official X account. MANTRA and Nesa advised of chain halts before the warning. No user funds appeared to be affected on those networks. KiiChain wallets lost almost 150 million KII on August 22. The tokens were worth more than $9 million at the time. The proceeds were sold for $1.6 million in BUSD. The sale briefly crashed KII's price. KiiChain called the loss avoidable in a postmortem report. KiiChain blamed Cosmos Labs' disclosure process. The report said the public release of the fix exposed the vulnerability before affected chains received private notice and time to patch. The report also cited a lack of advance notice. The report cited a failure to mark the update as critical. The report cited delayed communication of the patch. TAC lost three billion TAC tokens from its staking contract on the same day. The tokens were valued at around $7.5 million. Saga EVM lost approximately $7 million in January. Cosmos Labs had not responded to a request for details on private disclosures by publication time.