On June 19, the blockchain project Axelar disclosed a hack of its bridge with the Secret Network protocol. The attacker withdrew about $4.67 million by exploiting an "infinite mint" vulnerability. We analyzed the Secret Network incident. An attacker exploited an infinite-mint bug in a modified CW20-ICS20 token contract on Secret to drain ≈$4.67M. The attacker minted arbitrary Secret-wrapped Axelar assets on Secret by spinning up a new Cosmos chain with 1 validator and… The theft went unnoticed for seven days. According to Axelar's core developer, Common Prefix, the bug was found in the ICS-20 smart contract on the Secret side of the Cosmos IBC connection. The algorithm created "wrapped" versions of assets (saToken) but did not verify which channel the incoming transaction came from. This allowed the attacker to falsify deposits and issue tokens without backing. Since the operations did not require permission, he launched a chain in Cosmos with a single validator, from which he sent packets with fake asset denominations. Axelar's emergency committee disabled the Secret and Secret-SNIP connections to stop further unauthorized transfers. The team is coordinating with exchanges and law enforcement to trace the funds and assist with their recovery. According to the statement, the incident is limited to the saUSDT, saUSDC, saDAI, saWETH, saWBTC, saWBNB, and sawstETH coins. The core Axelar protocol, other IBC connections, and the native assets of Secret Network are not affected. Despite the report of the theft, the price of the Secret token (SCRT) briefly jumped nearly 6%, reaching $0.06. After a correction, the asset is trading around $0.058, maintaining a daily gain of about 3%. Its market capitalization stands at roughly $20 million.

Source: ForkLog