Provenance Blockchain Vulnerability Allows Unauthorized Admin Control Over Financial Asset Markers
A critical flaw in Provenance Blockchain's marker module allowed any user to gain administrative privileges over 82 live financial asset markers, potentially enabling token minting or escrowed asset theft.
Trail of Bits researchers have uncovered a significant vulnerability in the Provenance Blockchain, a public proof-of-stake chain utilized for various financial services, including tokenized loans and asset registries. The flaw, present in versions prior to 1.28.0, enabled any user to grant themselves administrative control over 'marker' accounts without possessing any of the associated tokens.
Markers are fundamental to Provenance's fungible token system, acting as accounts that manage a token's denomination, access controls, supply, and escrow balance. They can be configured as either 'supply_fixed' or 'non-fixed.' The vulnerability specifically targets non-fixed supply markers, particularly those activated with an initial zero supply. In these cases, the blockchain's accountControlsAllSupply function incorrectly compares the marker's stored zero supply with a user's zero balance, leading to a false positive authorization check.
The exploit hinges on a flawed authorization check within the AddAccess message handler. This handler typically verifies if a caller is authorized to modify a marker's access control list. One of the conditions for authorization is controlling 100% of the marker's circulating supply. However, due to the bug in accountControlsAllSupply for non-fixed supply markers with zero initial supply, this condition evaluates to true for any user, regardless of their token holdings.
Exploitation requires just two transactions. First, an attacker sends a MsgAddAccessRequest to grant themselves ACCESS_ADMIN, ACCESS_MINT, and ACCESS_WITHDRAW permissions on a target marker. The flawed authorization check passes seamlessly. Once granted these permissions, the attacker can then execute a second transaction to either mint new tokens of that marker's denomination or drain any assets held within the marker's escrow balance.
At the time of discovery in March 2026, 82 active markers on the Provenance mainnet were susceptible to this attack. These markers represented a diverse range of live financial assets, including bridged stablecoins, wrapped assets, consortium deposits, and yield tokens. The potential impact was substantial: escrowed assets in the largest affected markers alone were valued at approximately $500,000 in native HASH tokens. The ability to mint arbitrary new tokens also posed a significant risk, depending on the specific token type and its associated KYC requirements.
Trail of Bits reported the vulnerability to Provenance on April 1, 2026. The issue was addressed in pull request #2627, which was merged into the codebase and subsequently shipped in version 1.28.0 on May 1, 2026. This fix corrected the logic in the accountControlsAllSupply function, ensuring that the authorization check accurately reflects supply ownership and prevents unauthorized access.
The incident highlights the critical importance of rigorous security auditing, especially within blockchain protocols that manage significant financial assets. The subtle state divergence between the marker's stored supply and the bank module's actual circulating supply created a window for exploitation, underscoring the need for precise state management and comprehensive validation in smart contract and blockchain development.