Loading today’s stories
Security1 distinct publisher2 min readPublished
Trail of Bits found an authorization branch that compared a caller's balance against a supply figure the chain stops updating. Zero matched zero, and the check passed for everybody.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
The condition that broke was not unreasonable on its face. If one address holds every unit of a token in circulation, treating it as the owner is defensible, and the `AddAccess` handler offered that as one of three sufficient tests, alongside being the designated manager of a `Finalized` marker or already holding `ACCESS_ADMIN` [7]. The defect is in where the denominator came from. `accountControlsAllSupply` calls `m.GetSupply`, which reads a supply field stored on the marker struct itself [8]. For markers whose supply is not fixed, the bank module is the source of truth and that field is only informational [6], and Provenance never writes back to it after minting [9]. A non-fixed marker activated with zero supply therefore reports zero supply for life, and the comparison resolves in favour of any caller with an empty balance [10].
That is the reusable lesson: a permission decision was made against a cached copy of a quantity another module owns [5][6]. Nothing in the marker's access control list was misconfigured, and no key was compromised.
Trail of Bits groups 74 of the 82 markers under the supply-inflation path [14][4], leaving eight described mainly through escrow, which is where the concrete money sat. Markers holding nhash in escrow came to roughly 30 x 10^15 nhash, about $500,000 at HASH prices when the bug was found [12]. The three largest are Provenance Foundation governance programs: one holding validator rewards, two holding community grant funds [13].
The mint path has no equivalent ceiling. An attacker holding `ACCESS_MINT` could issue arbitrary new tokens of the denom [15], and the denoms include bridged stablecoins and wrapped assets (`uusd.trading`, `uusdc.figure.se`, `nbtc.figure.se`), consortium deposits (`cusd.deposit`), tokenized mortgage participations (`cguaranteedrateomni`, `chomebridgeomni`), and yield tokens (`nuva.ylds`, `uylds.fcc`) [14]. Trail of Bits separates the two harms: for restricted tokens carrying KYC requirements the damage is to solvency and integrity, while non-restricted coin-type markers face direct inflation [16]. The second is a theft; the first is a discrepancy between what a registry says exists and what a servicer can account for, which tends to surface at reconciliation rather than at the block explorer.
The affected set was confirmed by querying mainnet through the Provenance CLI [17]. Worth sitting with: identifying every exploitable marker was a public read against the chain, requiring no insider knowledge of any issuer. Provenance shipped the correction in PR #2627 [3], 30 days after the April 1 report [18]. Everything before v1.28.0 carries the original check [2], and the date a fix is released is not the date a validator set runs it.
Ranked by verification strength, evidence, and original report placement.
Trail of Bits found and reported a bug in Provenance Blockchain, a public proof-of-stake chain built on the Cosmos SDK, that lets any user grant themselves admin control over marker accounts without holding a single token.
The bug affects Provenance versions before 1.28.0; Trail of Bits found it in March 2026 and reported it to Provenance on April 1, 2026.
At the time of discovery, 82 active markers on Provenance mainnet had a stored supply of 0 while carrying real circulating supply or escrowed assets, and every one was exploitable; they span multiple independent parties on the chain, not a single application.
The marker module is Provenance's core primitive for fungible tokens; each marker is a special account controlling a denomination, an access control list governing who can mint, burn, withdraw, deposit or administer the token, a supply field recording the canonical token count, and an escrow balance that can hold any asset.
Markers are either supply_fixed, where the supply field is enforced as a hard cap, or non-fixed, where the bank module is the source of truth and the supply field is informational.
AddAccess authorizes a caller if any one of three conditions holds: the caller is the marker's designated manager and the marker is Finalized; the caller already holds ACCESS_ADMIN; or the caller controls 100% of the marker's circulating supply.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Detailed first-party technical evidence, not independently replicated
The single source supplies a specific code path (AddAccess, accountControlsAllSupply, m.GetSupply), a named root cause, a two-message exploit chain, a patched version and commit, and a quantified mainnet inventory the finder says it verified by querying the chain. That is unusually concrete. It is capped by being one publisher who is also the discoverer, with no vendor advisory, no independent replication, and an unreconciled discrepancy between two PR numbers given for the same fix.
Real deployed exposure and a shipped patch; upgrade uptake unknown
Adoption evidence is strong on the exposure side: 82 live mainnet markers held real circulating or escrowed assets across multiple independent parties, including Provenance Foundation governance programs and roughly $500,000 of escrowed nhash, and a fix shipped in a numbered release. It is held below high because nothing in the sources shows how many validators or node operators have upgraded to v1.28.0, and no issuer or vendor remediation status is reported.
Restrained framing, slightly understated severity
The post's language tracks its evidence closely: it reports a patched bug, avoids claiming exploitation, distinguishes direct escrow drainage from more constrained inflation risk, and separates KYC-restricted from non-restricted harm. If anything the headline framing understates the case, since an unauthenticated two-transaction takeover of 82 live financial markers is more severe than the measured tone suggests. The small negative value reflects that, offset by the fact that the exposure is described by the party whose finding it is.
Disclosing security firm publicizing its own finding; affected parties silent
The only voice in the cluster is the audit firm that found the bug, and vulnerability write-ups are direct marketing for security-assessment services, so severity and breadth framing carry a commercial interest. Mitigating factors are the coordinated timeline, the version- and commit-level specificity that invites checking, and the absence of any product pitch in the supplied text. Provenance, the Provenance Foundation, and the token issuers named through their denominations are entirely unrepresented, so no countervailing incentive is visible in the sources.
Technically credible but single-sourced and partly unreconciled
Confidence is supported by code-level specificity, a named patched release, and quantified on-chain measurements. It is limited by structural gaps: one publisher who is the interested finder, no vendor or issuer confirmation, two conflicting PR references for the same fix, no data on operator upgrade uptake, and no statement on whether exploitation occurred.
security
Two Artifactory flaws poisoned metadata, not artifacts, and that was enough to break a shared cache1 distinct publisher
invest
Cosmostation shuts every wallet platform on September 1, leaving 18 days and a key export1 distinct publisher
security
Akrites switches on in September with 20-odd members and a one-to-10 engineer donation band1 distinct publisher
security
Windows 11's secure kernel trusts a RAM chip that never checks who is writing to it1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 25, 2026