Security firm Trail of Bits has disclosed an authorization flaw in the Provenance Blockchain that exposed 82 live mainnet asset accounts, known as markers, to potential takeover by users holding no tokens. If exploited, the bug could have allowed unauthorized token minting or the withdrawal of assets held in escrow.
Markers are special asset accounts that govern a token's supply, permissions, and escrow balance. According to Trail of Bits, the flaw allowed an account holding zero tokens to claim administrative, minting, and withdrawal permissions for a marker by exploiting a mismatch between two records of token supply.
For non-fixed markers, Provenance's bank module tracks the live circulating supply, while the marker's own supply field can remain at zero. The authorization check erroneously read the stale marker field to test if an account held the entire supply. Because a new account's balance was also zero, the validation check treated zero as equal to zero and approved the permission change.
The vulnerability placed approximately $500,000 in HASH escrow at risk across 30 quadrillion nhash. Three Provenance Blockchain Foundation programs held the majority of this amount: grant0051, provenance.validator.incentive.program, and grant0077. Additionally, a subset of 74 markers faced unauthorized minting risks, affecting bridged stablecoins, wrapped assets, consortium deposits, tokenized mortgage participations, and yield tokens.
Named examples of affected assets included uusd.trading, uusdc.figure.se, nbtc.figure.se, cusd.deposit, cguaranteedrateomni, chomebridgeomni, nuva.ylds, and uylds.fcc. Trail of Bits noted that unrestricted coin-type markers faced direct inflation risks, while restricted tokens faced supply-integrity and solvency challenges.
Trail of Bits discovered the vulnerability in March and reported it to Provenance on April 1. A zero-supply guard deployed in version v1.28.0 on May 1 blocked the reported attack path. A subsequent update in version v1.29.0 on June 8 updated the authorization check to read the live supply directly from the bank module. GitHub records confirm the code changes were merged and released, and the disclosure did not confirm any actual exploitation or unauthorized access.
