Provenance Bug Exposes 82 Asset Accounts to Takeover

A critical bug in the Provenance blockchain exposed 82 live mainnet asset accounts to takeover, allowing users without tokens to seize control and potentially mint new tokens or withdraw assets from escrow.

The flaw, discovered by Trail of Bits in March and reported to Provenance on April 1, was caused by a mismatch between two records of token supply. As a result, the authorization check treated zero as equal to zero, approving permission changes even if an account held no tokens.

All 82 affected markers had zero stored supply while carrying real circulating supply or assets in escrow, totaling around $500,000 worth of HASH at the time of discovery.

The bug posed a significant risk to token supply and solvency for certain restricted tokens with identity requirements. However, it is unclear whether any attackers exploited this vulnerability before Provenance implemented fixes on May 1 and June 8.