Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Provenance is a Cosmos SDK blockchain. It contains the transaction type MsgAddMarkerRequest to create a new asset on the chain. This is dedicated to an account called a marker to specify the denomination, a list of users who can perform actions, the supply, and the escrow balance. Since the token is isolated to a particular user and it's permissioned, this would make it safe.

AddAccess is a message handler that processes a request to modify the markers' access control list. It has three checks and only one of them must be true:

1. The caller is the marker's designated manager
2. The caller holds the ACCESS_ADMIN field on the marker.
3. The caller controls 100% of the marker's circulating supply.

The check calls m.GetSupply() on the marker struct. For non-fixed supply markets that were activated with zero supply, this is always zero. The live circulating count lives int he bank module, and is very written back to the marker struct upon minting. Thus, the authorization check turns into 0 == 0.

To exploit, you submit a transaction that sends a single MsgAddAccessRequest with yourself as an admin and a minter. Then mint new tokens or withdraw the token's underlying asset. With 82 active markers, this could have led to $500K being stolen.

The vulnerability is an access control issue. The bug itself stems from a bad check that fails open on authorization. Overall, a great and terse post!