Zero-balance bug let empty wallets seize 82 Provenance markers

Security firm Trail of Bits disclosed a vulnerability on the Provenance blockchain that allowed empty wallets to assume admin, mint and withdrawal permissions on marker accounts. The issue affected live mainnet markers and exposed token supply and escrow balances to potential unauthorized actions.

The flaw stemmed from a mismatch between two supply records. For non-fixed markers, Provenance’s bank module tracks live circulating supply while each marker stores its own supply value. Many markers retained a stored supply of zero even though the bank module showed positive circulating balances. An authorization check read the stale stored supply value and treated a new account’s zero balance as holding the entire supply, allowing a permission change that could be used in a subsequent transaction.

Trail of Bits identified 82 live marker accounts at risk and flagged a high-risk subset of 74 markers that could be directly inflated by unauthorized minting. Affected assets included bridged stablecoins, wrapped tokens, consortium deposits, tokenized mortgage participations and yield tokens. Examples named in the disclosure included uusd.trading, uusdc.figure.se, nbtc.figure.se, cusd.deposit, cguaranteedrateomni, chomebridgeomni, nuva.ylds and uylds.fcc.

The insecure state held roughly 30 quadrillion nhash in escrow, which was valued at about $500,000 in HASH at the time of discovery. Most of that balance was concentrated in three Provenance programs: grant0051 (about 19.23 quadrillion nhash), provenance.validator.incentive.program (about 8.56 quadrillion) and grant0077 (about 2.49 quadrillion). The disclosure described both a withdrawal risk from escrow and an unauthorized minting risk where markers had no transfer or identity restrictions.

Trail of Bits reported finding the bug in March and notified Provenance on April 1. Provenance released a zero-supply guard in v1.28.0 on May 1 that blocked the specific attack path described. A subsequent change in v1.29.0 on June 8 updated the authorization check to read live supply from the bank module. GitHub records show the relevant code changes were merged and published.

The risk varied by token type. For unrestricted coin-type markers the vulnerability created a direct inflation threat. For restricted tokens that require identity checks or transfer limits, newly minted units could still affect reported supply and program solvency even if an attacker could not freely move tokens.

The disclosure did not confirm whether chain analysis found any instances of exploitation, nor did it specify whether affected issuers and users were directly notified.