Session Fixation

Evmos is vulnerable to Session Fixation. The vulnerability is due to the improper handling of contract balances during interchain transactions involving a local state change and an ICS20 transfer. An attacker can exploit this flaw to artificially increase the supply of Evmos tokens by manipulating the sender parameter in the ICS20 transfer function. This is only exploitable if the contract address is used as the sender in an ICS20 transfer.