Zero-balance bug exposes 82 Provenance assets to takeover

A flaw in the Provenance Blockchain authorization system allowed empty wallets to take control of 82 live mainnet asset accounts. This vulnerability enabled unauthorized users to mint affected tokens or withdraw assets held in escrow. The special asset accounts, known as markers, manage a token's supply, permissions, and escrow balance. The issue arose from a mismatch in token supply records, where the authorization check incorrectly approved permission changes for new accounts with zero balances. All 82 affected markers had zero stored supply while possessing real circulating supply or assets in escrow. The total escrowed nhash affected was approximately 30 quadrillion, valued at about 500000 dollars when discovered. Most of this was held by three Provenance Blockchain Foundation programs. A subset of 74 markers faced unauthorized minting risks, including bridged stablecoins and wrapped assets. Trail of Bits identified the flaw in March and reported it on April 1. A zero-supply guard was implemented on May 1 to block the vulnerability, and further changes were made to the authorization check in the June 8 update. The disclosure does not confirm if any unauthorized access or minting occurred.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.