Trail of Bits Blog·· 2026-08-25精选AI 评分66
Trail of Bits 披露 Provenance Blockchain 授权漏洞，82 个 marker 可被无代币夺取管理员权限
State divergence enables unauthorized access
AI brief
We found and reported a bug in Provenance Blockchain, a public proof-of-stake chain built on Cosmos SDK , that lets any user grant themselves admin control over marker accounts without holding a single token. Provenance covers a range of financial services, including on-chain tokenized loans, private equity tokens, bri…
Why it matters
The article fully discloses the cause of the authorization check reading a stale supply field, the exploit paths of two transactions, and the fix differences, serving as a case reference for on-chain permission validation.
Source: Trail of Bits Blog · blog.trailofbits.com