A state divergence bug in Provenance Blockchain's marker module allowed any user to bypass access control checks on non-fixed supply markers. The authorization function accountControlsAllSupply compared a stale stored supply field (always zero for non-fixed markers) against the caller's balance, producing an unconditionally true result when both were zero. This let an attacker grant themselves admin, mint, and withdraw permissions in a single transaction, then mint arbitrary tokens or drain escrowed assets in a second transaction. 82 markers on mainnet were affected, with approximately $500,000 in escrowed nhash at direct risk.
Cosmos SDK
1 post
State divergence enables unauthorized access