Security Not yet confirmed elsewhere 1 publisher2 min readPublished Aug 25, 2026, 5:13 AM PDT

Provenance's marker module let anyone with zero tokens claim admin over 82 live financial assets

Trail of Bits found an authorization branch that compared a caller's balance against a supply figure the chain stops updating. Zero matched zero, and the check passed for everybody.

The Watch · Security desk

How we use AI Send a correction

What happened

Trail of Bits reported a flaw in Provenance Blockchain's marker module that let any address grant itself admin rights over a token while holding none of it.
Eighty-two live mainnet markers held by multiple independent parties qualified, including bridged stablecoins, tokenized mortgage participations and yield tokens.
Taking the permission and acting on it required two transactions and no starting balance: one to add access, one to mint or to drain escrow.

Why it matters

exposure The richest reachable balances were the Provenance Foundation's own governance accounts for validator rewards and grant funds, so the cheapest theft ran through the entity that would have had to...
cost With no capital requirement, there was no economic friction to slow anyone who found the branch independently, and the eventual bill would have landed on issuers whose denominations were inflated.
constraint Where KYC restrictions blocked an attacker from spending minted tokens, the loss would still register as an accounting hole, which is harder to detect and slower to unwind than an emptied escrow.
precedent Any Cosmos SDK module that authorizes against its own stored copy of a figure the bank module actually owns can be talked into the same handover, which makes this a review pattern rather than one...

The condition that broke was not unreasonable on its face. If one address holds every unit of a token in circulation, treating it as the owner is defensible, and the `AddAccess` handler offered that as one of three sufficient tests, alongside being the designated manager of a `Finalized` marker or already holding `ACCESS_ADMIN` ^[6]. The defect is in where the denominator came from. `accountControlsAllSupply` calls `m.GetSupply`, which reads a supply field stored on the marker struct itself ^[7]. For markers whose supply is not fixed, the bank module is the source of truth and that field is only informational ^[5], and Provenance never writes back to it after minting ^[8]. A non-fixed marker activated with zero supply therefore reports zero supply for life, and the comparison resolves in favour of any caller with an empty balance ^[9].

That is the reusable lesson: a permission decision was made against a cached copy of a quantity another module owns ^[4]^[5]. Nothing in the marker's access control list was misconfigured, and no key was compromised.

Trail of Bits groups 74 of the 82 markers under the supply-inflation path ^[13]^[3], leaving eight described mainly through escrow, which is where the concrete money sat. Markers holding nhash in escrow came to roughly 30 x 10^15 nhash, about $500,000 at HASH prices when the bug was found ^[11]. The three largest are Provenance Foundation governance programs: one holding validator rewards, two holding community grant funds ^[12].

The mint path has no equivalent ceiling. An attacker holding `ACCESS_MINT` could issue arbitrary new tokens of the denom ^[14], and the denoms include bridged stablecoins and wrapped assets (`uusd.trading`, `uusdc.figure.se`, `nbtc.figure.se`), consortium deposits (`cusd.deposit`), tokenized mortgage participations (`cguaranteedrateomni`, `chomebridgeomni`), and yield tokens (`nuva.ylds`, `uylds.fcc`) ^[13]. Trail of Bits separates the two harms: for restricted tokens carrying KYC requirements the damage is to solvency and integrity, while non-restricted coin-type markers face direct inflation ^[15]. The second is a theft; the first is a discrepancy between what a registry says exists and what a servicer can account for, which tends to surface at reconciliation rather than at the block explorer.

The affected set was confirmed by querying mainnet through the Provenance CLI ^[16]. Worth sitting with: identifying every exploitable marker was a public read against the chain, requiring no insider knowledge of any issuer. Provenance shipped the correction in PR #2627 ^[19], 30 days after the April 1 report ^[17]. Everything before v1.28.0 carries the original check ^[2], and the date a fix is released is not the date a validator set runs it.

What to watch

Whether Provenance publishes upgrade coverage for v1.28.0 across its validator set, since any node below that version still runs the original check.
Whether other Cosmos SDK projects reuse the 100%-of-supply authorization shortcut against a locally stored supply value.
Whether on-chain history for any of the 82 markers shows the access path being exercised before the May 1 release.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence76
Adoption58
Hype gap−6
Incentives66
Confidence62

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Trail of Bits found and reported a bug in Provenance Blockchain, a public proof-of-stake chain built on the Cosmos SDK, that lets any user grant themselves admin control over marker accounts without holding a single token.
ReportedSupportedSource: Trail of BitsView cited source
[2]
The bug affects Provenance versions before 1.28.0; Trail of Bits found it in March 2026 and reported it to Provenance on April 1, 2026.
ReportedSupportedView cited source
[3]
At the time of discovery, 82 active markers on Provenance mainnet had a stored supply of 0 while carrying real circulating supply or escrowed assets, and every one was exploitable; they span multiple independent parties on the chain, not a single application.
ReportedSupportedView cited source
[4]
The marker module is Provenance's core primitive for fungible tokens; each marker is a special account controlling a denomination, an access control list governing who can mint, burn, withdraw, deposit or administer the token, a supply field recording the canonical token count, and an escrow balance that can hold any asset.
ReportedSupportedView cited source
[5]
Markers are either supply_fixed, where the supply field is enforced as a hard cap, or non-fixed, where the bank module is the source of truth and the supply field is informational.
ReportedSupportedView cited source
[6]
AddAccess authorizes a caller if any one of three conditions holds: the caller is the marker's designated manager and the marker is Finalized; the caller already holds ACCESS_ADMIN; or the caller controls 100% of the marker's circulating supply.
ReportedSupportedView cited source
[7]
The 100%-of-supply condition is implemented by accountControlsAllSupply, and m.GetSupply reads the supply field stored directly on the marker struct.
ReportedSupportedView cited source
[8]
For non-fixed supply markers activated with zero supply the stored supply field always stays zero; the live circulating count lives in the bank module, and non-fixed markers never write back to the marker struct after minting.
ReportedSupportedView cited source
[9]
The check intended to restrict access to holders of 100% of supply becomes unconditionally true for any caller with a zero balance.
ReportedSupportedView cited source
[10]
Exploitation requires no existing tokens: one MsgAddAccessRequest passes the broken condition, after which the attacker can send MsgMintRequest to mint new tokens of the denom or MsgWithdrawRequest to drain assets in the marker's escrow, making the whole attack two transactions.
ReportedSupportedView cited source
[11]
Among the affected markers, those holding nhash (Provenance's base token) in escrow accounted for roughly 30 x 10^15 nhash, around $500,000 at HASH prices at the time of discovery.
ReportedSupportedView cited source
[12]
The three largest affected markers are chain governance programs operated by the Provenance Foundation: one holds validator rewards and two hold community grant funds.
ReportedSupportedView cited source
[13]
The 74 vulnerable markers in the supply-inflation group spanned bridged stablecoins and wrapped assets (uusd.trading, uusdc.figure.se, nbtc.figure.se), consortium deposits (cusd.deposit), tokenized mortgage participations (cguaranteedrateomni, chomebridgeomni), and yield tokens (nuva.ylds, uylds.fcc).
ReportedSupportedView cited source
[14]
An attacker with ACCESS_MINT on any of the affected markers could issue arbitrary new tokens of that denomination.
ReportedSupportedView cited source
[15]
For restricted tokens with KYC requirements the harm was primarily a solvency and integrity threat; for non-restricted coin-type markers it was a more direct inflation risk.
ReportedSupportedSource: Trail of BitsView cited source
[16]
Trail of Bits confirmed the affected markers and their balances by querying mainnet via the Provenance CLI.
ReportedSupportedView cited source
[17]
Thirty days elapsed between the April 1, 2026 report and the May 1, 2026 release of v1.28.0 containing the fix.
DerivedSupported1 source— create a free account to open them
[18]
Eight of the 82 affected markers fall outside the 74 described under the supply-inflation path.
DerivedSupported1 source— create a free account to open them
[19]
The bug was fixed in PR #2627 (commit c81fd65), which shipped in v1.28.0 on May 1, 2026.
ReportedContested3 sources— create a free account to open them View cited source

Sources

1 independent publisher whose own reporting we read for this story.

blog.trailofbits.com
1 article · August 25, 2026
State divergence enables unauthorized access

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

The technical core is a state-divergence authorization bug: Provenance's marker module keeps a supply field on the marker struct while the bank module holds live supply for non-fixed markers, and the AddAccess handler's third authorization condition (accountControlsAllSupply via m.GetSupply) read the stale struct field. For non-fixed markers activated at zero supply that field stays zero forever, so balance == supply collapsed to 0 == 0 and passed for any caller with no tokens. The exploit chain is two messages: MsgAddAccessRequest to self-grant, then MsgMintRequest or MsgWithdrawRequest. The fix reads live bank supply and adds a zero-guard so an unfunded marker cannot be self-claimed either. The transferable rule stated by the source - an authorization predicate must never be satisfiable from the attacker's default state - applies to any Cosmos SDK module or contract that duplicates state across modules.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence76: 0100
Detailed first-party technical evidence, not independently replicated
The single source supplies a specific code path (AddAccess, accountControlsAllSupply, m.GetSupply), a named root cause, a two-message exploit chain, a patched version and commit, and a quantified mainnet inventory the finder says it verified by querying the chain. That is unusually concrete. It is capped by being one publisher who is also the discoverer, with no vendor advisory, no independent replication, and an unreconciled discrepancy between two PR numbers given for the same fix.
Adoption58: 0100
Real deployed exposure and a shipped patch; upgrade uptake unknown
Adoption evidence is strong on the exposure side: 82 live mainnet markers held real circulating or escrowed assets across multiple independent parties, including Provenance Foundation governance programs and roughly $500,000 of escrowed nhash, and a fix shipped in a numbered release. It is held below high because nothing in the sources shows how many validators or node operators have upgraded to v1.28.0, and no issuer or vendor remediation status is reported.
Hype gap−6: −100 understated0 aligned+100 overstated
Restrained framing, slightly understated severity
The post's language tracks its evidence closely: it reports a patched bug, avoids claiming exploitation, distinguishes direct escrow drainage from more constrained inflation risk, and separates KYC-restricted from non-restricted harm. If anything the headline framing understates the case, since an unauthenticated two-transaction takeover of 82 live financial markers is more severe than the measured tone suggests. The small negative value reflects that, offset by the fact that the exposure is described by the party whose finding it is.
Incentives66: 0100
Disclosing security firm publicizing its own finding; affected parties silent
The only voice in the cluster is the audit firm that found the bug, and vulnerability write-ups are direct marketing for security-assessment services, so severity and breadth framing carry a commercial interest. Mitigating factors are the coordinated timeline, the version- and commit-level specificity that invites checking, and the absence of any product pitch in the supplied text. Provenance, the Provenance Foundation, and the token issuers named through their denominations are entirely unrepresented, so no countervailing incentive is visible in the sources.
Confidence62: 0100
Technically credible but single-sourced and partly unreconciled
Confidence is supported by code-level specificity, a named patched release, and quantified on-chain measurements. It is limited by structural gaps: one publisher who is the interested finder, no vendor or issuer confirmation, two conflicting PR references for the same fix, no data on operator upgrade uptake, and no statement on whether exploitation occurred.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Blockchain State DesynchronizationFollow
Authorization Bypass PatternsFollow
Tokenized Real-World Assets Follow
Coordinated Vulnerability Disclosure Follow
Cosmos SDK Module SecurityFollow

Entities

Trail of Bits Follow
Provenance BlockchainFollow
Provenance marker moduleFollow
Cosmos SDK Follow
Provenance FoundationFollow
HASH / nhashFollow