Security researcher Doyeon Park has publicly disclosed a CVSS 7.1 high-severity zero-day in CometBFT, the consensus layer used across much of the Cosmos ecosystem. Park said the flaw can cause nodes to stall during block synchronization, putting networks that secure more than $8 billion in on-chain value at operational risk.
According to Park, the bug does not enable direct asset theft. The concern is network disruption: if block production or synchronization is delayed across multiple Cosmos-based chains, validators, applications, and users can all face serious knock-on effects. Funds may not be immediately drainable, but a stalled chain can still create economic damage.
Public disclosure followed a breakdown in coordination
In a post on X, Park said the exploit was made public only after attempts to handle the issue through standard coordinated vulnerability disclosure channels failed. The researcher attributed that outcome to a “lack of cooperation” from the vendor, turning the episode into a broader dispute over how critical flaws in shared blockchain infrastructure should be handled.
That tension is familiar in open-source systems. Transparency matters, yet so does keeping severe consensus bugs contained until fixes are ready. In this case, the move to publish the issue has drawn attention to the lack of clear expectations around timelines, responsibilities, and emergency response for vulnerabilities in core protocol components.
CometBFT sits at the center of many Cosmos-SDK chains
Because CometBFT underpins consensus for many Cosmos-SDK-based networks, a stall during block sync can spread beyond a single chain. The source material notes that the fallout may reach IBC transfers as well as DeFi protocols running on affected networks.
Even without direct theft, prolonged node stalls can trigger governance emergencies, slashing disputes, and liquidity disruptions. The risk is more acute on chains that function as major routing hubs or host dollar-denominated stablecoins. The disclosure is now putting Cosmos security processes under fresh pressure, especially around how consensus-layer issues are escalated and resolved.