Woofun AI reports that Trail of Bits identified a critical authorization vulnerability within the Provenance Blockchain, exposing 82 live mainnet asset accounts, known as markers, to potential takeover by empty wallets. The core mechanism of this exploit relied on a zero-balance bug interacting with a stale marker field, allowing attackers to bypass standard permission checks. This structural flaw meant that accounts holding no tokens could effectively impersonate authorized entities, threatening the integrity of the entire asset governance system.

The technical root cause lay in a logic error where the system tested whether an account held the entire supply to grant admin, mint, and withdrawal permissions. Because a new, empty account had a balance of zero, and the affected markers also had a zero stored supply, the authorization check treated zero as equal to zero, approving the permission change. Consequently, an attacker could execute a second transaction to seize control, despite the markers carrying real circulating supply or assets in escrow. This discrepancy between stored and actual supply created a window for unauthorized manipulation of token permissions.

Woofun AI data shows that financially, the exposure was significant, with roughly 30 quadrillion nhash, valued at approximately $500,000 at HASH prices, held in vulnerable escrow accounts. Major holders included grant0051 with 19.23 quadrillion nhash, provenance.validator.incentive.program with 8.56 quadrillion, and grant0077 with 2.49 quadrillion. A subset of 74 markers faced direct inflation risk, encompassing bridged stablecoins like uusd.trading and uusdc.figure.se, wrapped assets such as nbtc.figure.se, and yield tokens including nuva.ylds and uylds.fcc. While unrestricted coin-type markers faced direct inflation, restricted tokens with identity requirements encountered supply-integrity and solvency risks, even if newly minted units could not be freely transferred.

GitHub records confirm that the necessary code changes were merged and released to address the vulnerability.

However, the disclosure from Trail of Bits does not clarify whether chain analysis detected any unauthorized access, minting, or withdrawals prior to the patch. It remains unclear if affected issuers and users were notified of the potential breach, leaving the extent of any realized financial damage uncertain. This incident highlights the persistent risks associated with complex permission structures in blockchain asset management.