Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Secret Network is a privacy preserving Cosmos appchain. Axelar is a bridging provider from outside of the Cosmos ecosystem, such as Ethereum. The vulnerability was in the integration between Axelar, and Secret Network asset types.

Cosmos has the Inter-blockchain Communication (IBC) protocol for sending tokens between blockchains. Separated tokens via ICS20 is important so there's no confusion between types.These are shown with a format like ibc/<32_byte_hash> but also contain the denomination in them as well.

snip-ics20 tokens are the privacy-preserving version of Cosmos denoms. To make this work on CosmWasm, there's a translation layer from ICS20 denoms to CW20 denom representation. To make this work with Axelar, a fork was created to support it with custom whitelisted asset types.

In the function do_ibc_packet_receive(), there is code to bind the voucher to the channel it arrived. This is important because USDC on one chain is not the same as USDC on Axelar. The fork comments out two important checks: one that validates the port/channel mapping against the real source, and another that caps the release at the amount that the channel has escrowed. Yikes!

The allowlist for Axelar assets was keyed on the denom name rather than the channel. This made channel-227 from the attackers chain with uudst indistinguishable from Axelar's legitimate channel-69.

Approximately $4.67M worth of tokens was stolen from the various Secret Network wrapped versions of the tokens. The attacker minted the tokens, and then redeemed them over the legitimate IBC Axelar channel. Secret Network detected the incident and disabled the connection to Axelar. They follow this up with a funds analysis as well. The attack took 7 days to find and was only noticed because of an unescrow failure.

Overall, a really sad exploit for a necessary and known-about check on the IBC flow. Good isolation by Axelar in this case.