fix(security): pin evm to the deployed commit, not the merged tip (testnet/v37)

[skosito]

Repins cosmos/evm to the commit live v37.0.3 was built from.

- github.com/zeta-chain/evm v0.0.0-20260903155126-a69d910e9214   (#4638, merged release/v37 tip)
+ github.com/zeta-chain/evm v0.0.0-20260825060942-198da04bfbd3   (what v37.0.3 ships)

Why

#4638 pinned the squash-merged release/v37 tip. That tip includes the follow-up commit re-gating the module-account guard on the chain's blocked-receive policy:

// 51190f04 — what #4638 pinned
if delta.Sign() != 0 && k.bankWrapper.BlockedAddr(cosmosAddr) {

// 198da04b — what live v37.0.3 runs
if delta.Sign() != 0 {
    if acct := k.accountKeeper.GetAccount(ctx, cosmosAddr); acct != nil {
        if _, isModule := acct.(sdk.ModuleAccountI); isModule {

ZetaChain's blocked-receive set is a strict subset of its module accounts — x/fungible, x/crosschain and emissions are deliberately not blocked. So for an unblocked module account with a non-zero delta the two forms take different branches: reject vs. mint/burn. Same input, different state transition — consensus-breaking, and it cannot ship as a v37.0.x patch.

The private node PR pinned 198da04b deliberately for this reason; the blocked-receive guard was always meant to ship separately as a coordinated upgrade. Repinning to the merged tip collapsed that separation, because the squash merge made the pre-gating commit unselectable from release/v37.

The guard change is still wanted — it fixes real breakage around sends to emissions — just not in a patch release.

Note

198da04b is reachable via the sec/testnet-v37-complete branch on zeta-chain/evm. Do not delete that branch while this pin is live, or tag the commit to make it permanent.

Verification

go build ./cmd/zetacored green. Guard confirmed as the isModule form in the downloaded module, not just by SHA.

---

Note

High Risk
Changes which forked EVM bank/module-account logic is compiled into zetacored, directly affecting consensus state transitions for module balance updates.

Overview
Repins the github.com/cosmos/evm replace from the squash-merged release/v37 tip (a69d910e9214) to the older fork commit (198da04bfbd3) that live v37.0.3 was built against. go.sum is updated for the new pseudo-version.

The newer tip reintroduced a blocked-receive guard on non-zero balance deltas for module accounts. On ZetaChain, several module accounts (e.g. fungible, crosschain, emissions) are not on the blocked-receive list, so that guard can reject transfers where the deployed code still mints/burns—a consensus-breaking divergence that is inappropriate for a v37.0.x patch. This change restores dependency parity with what testnet/mainnet v37.0.3 already runs; the guard is intended for a later coordinated upgrade.

^{Reviewed by Cursor Bugbot for commit dd94ab2. Configure here.}

Greptile Summary

This PR restores the main module’s github.com/cosmos/evm replacement to the commit used by the deployed v37.0.3 binary, avoiding an unintended consensus-behavior change in a patch release.

• Repins github.com/zeta-chain/evm from a69d910e9214 to 198da04bfbd3.
• Adds the corresponding module and go.mod checksums.

Confidence Score: 5/5

The PR appears safe to merge, with the dependency replacement and checksums consistently selecting the intended deployed EVM commit.

No concrete changed-code failure remains; the manifest and checksum changes agree, while the reported transitive dependency advisories were already present on the base revision.

Important Files Changed

Filename	Overview
go.mod	Repins the EVM fork to the deployed v37.0.3 commit; no concrete defect was established in the replacement directive.
go.sum	Adds checksums matching the newly selected EVM pseudo-version; retained checksums for prior versions are harmless.

_{Reviews (1): Last reviewed commit: "fix(security): pin evm to the deployed c..." | Re-trigger Greptile}