fix(security): complete GHSA Aug-2026 statedb hardening (v35/mainnet)

[skosito]

Completes the balance-hardening port for the fork line that node release/v36 (mainnet) pins.

Changes

• SubBalance underflow guard + ParseAmount extended-denom handling — (pre-existing on this branch)
• Module-account guard, gated on delta.Sign() != 0 — keeps x/fungible's module-account EVM calls (incl. the BeginBlock gas-stability-pool burn) working; verbatim upstream guard would break them — (pre-existing)
• Snapshot locked balance on statedb account — (pre-existing, backport fix(statedb): snapshot locked balance on statedb account  cosmos/evm#1187)
• AddBalance overflow guard — panic on uint256 overflow (NEW, v0.6.3/v0.7.3 hotfix)
• StateDB.Commit() atomicity — stage the dirty set in a cache context so a late failure discards the whole commit, including precompile-staged writes (NEW)
• x/ibc/callbacks onPacketTimeout — use cachedCtx, not the live ctx (three sibling call sites already use cachedCtx; this one didn't) (NEW)
• TestCommitAtomicity regression test ported (NEW)

CI note

Advisory/private review — please run locally; do not rely on aggregate green (the fork's check_diff/test-solidity are red for unrelated reasons):

go test ./x/vm/statedb/... -tags test -count=1

TestCommitAtomicity is load-bearing: mutation-verified — reverting the Commit() change makes late failure discards precompile-staged writes too FAIL (the credited balance survives the error).

---

Note

High Risk
Touches core EVM–bank reconciliation, commit atomicity, and fund-blocking policy; mistakes could affect supply invariants, vesting correctness, or reintroduce statedb exploit paths.

Overview
Ports upstream cosmos/evm StateDB balance hardening into this fork: accounts now carry a locked-balance snapshot at load time, commit reconciles bank balances as spendable + locked via SetBalanceWithLocked / SetAccountBalance, and in-memory AddBalance / SubBalance panic on overflow and underflow.

StateDB.Commit() stages the full dirty set in a cache context (including folding journal state into the precompile cache) so a late SetAccount failure rolls back credits and precompile-staged writes. Mint/burn reconciliation is blocked for non-zero deltas to addresses on the chain’s BlockedAddr policy (not upstream’s blanket module-account ban), preserving module accounts such as x/fungible that may pay value through the EVM.

Supporting changes: LockedCoins plumbed through bank wrappers and precisebank; precompile ParseAmount sums base and extended EVM denoms; x/ibc/callbacks onPacketTimeout runs CallEVM on cachedCtx; ERC20 code registration reuses the existing statedb account. Regression coverage includes atomic commit, vesting delegation, and blocked-pool reconciliation tests.

^{Reviewed by Cursor Bugbot for commit feb2e93. Configure here.}

[kingpinXD]

lgtm
exact diff as the private pr

[morde08]

Approving on equivalence to the private fork PR, which I verified mechanically rather than by reading the diffs.

Equivalence to evm-fork-2026-08-24#1

This branch is the private branch plus exactly one commit:

• Commit SHAs are identical across the two repos (a8c94221b through feb2e93d3).
• Base tips are identical across the two repos: release/v35 = f0addce1e5ac.
• 21 files changed; for 20 of 21, both the pre- and post-image git blob hashes match the private PR. Blob hashes are content hashes, so those files are byte-identical.
• The only content delta is CHANGELOG.md, one line: the private entry linked the superseded/closed #31, this one correctly self-links #36. Verified that 46cc608e7 touches nothing else.

Also confirmed the private #1 and #2 diffs are byte-identical to each other, which backs the claim that the v35 and v37 statedb files were identical at base.

Coverage against live node pins

• node release/v36 (mainnet) pins evm f0addce1e5ac = base of #36
• node release/zetacore/v37 (testnet) and node main pin 515bbca4d348 = base of #37

So both live lines plus main are covered. release/v33, release/v34, release/v37-0.4, release/v37-latest are pinned by nothing live.

Substance

Spot-checked the security-critical hunks and they carry our two deliberate divergences from upstream, not the raw upstream guard: SetBalanceWithLocked gates on bankWrapper.BlockedAddr (not "is a module account") and only when delta.Sign() != 0, which is what keeps x/fungible's gas-stability-pool BeginBlock burn and the ZRC20-deploy path alive. Commit() stages through a cache context; AddBalance/SubBalance panic via AddOverflow / balance.Lt(amount); onPacketTimeout now matches its three cachedCtx siblings.

One non-blocking observation: DeleteAccount now calls SetBalanceWithLocked(ctx, addr, 0, new(big.Int)), so the target is 0 + 0 and it burns spendable + locked, where the old SetBalance path burned only spendable. Harmless while no account carries locked coins, and arguably the more correct semantics for a deleted account, but it is a behavior change that isn't called out in the description.

Before merging

Please don't read the current board as CI clearance — test-unit-cover, test-fuzz, golangci-lint and Analyze (go) are still queued here at 0s, and they are the first genuine run these commits will ever get: the same four lanes on the private fork were CANCELLED after sitting ~24h without a runner, which gh pr checks renders as "fail". Worth waiting for test-unit-cover and golangci-lint to actually report before merge.

test-solidity red is unrelated and base-identical: Could not find a compiler version matching 0.8.18, a solc-bin fetch failure. check_diff passes here, unlike in the private fork.