Empty Wallets, Big Problems: 82 Provenance Assets Exposed by Zero-Balance Bug
What went wrong
In short: a weird zero-balance quirk let empty wallets grab control of certain tokens on the Provenance blockchain. Security firm Trail of Bits found an authorization bug that made 82 live asset accounts — called markers — vulnerable to takeover. If abused, an attacker could mint tokens or pull assets out of escrow that they shouldn’t have touched.
Markers are special accounts that control a token’s supply, permissions, and escrowed holdings. The problem came down to a mismatch between two places the system keeps track of supply. The bank module stores the live circulating supply, while each marker has its own stored supply field. In some cases the marker’s stored supply was zero even though tokens were actually circulating or sitting in escrow.
The authorization check used the stale marker field when asking “does this wallet hold the entire supply?” A newly created account also has a balance of zero, so the check saw zero == zero and mistakenly granted powerful admin and withdrawal rights. In other words: two zeros walked into a bar, one said “I’m the whole supply,” and the system believed it.
Fixes, timeline, and who was at risk
Trail of Bits said it discovered the issue in March and reported it on April 1. The Provenance project rolled out a quick guard in v1.28.0 on May 1 that blocked the immediate attack path for the 82 identified markers. A follow-up change in v1.29.0 (released June 8) altered the authorization check so it reads live supply from the bank module instead of the stale marker field — essentially closing the loophole at its source. Repository records show the fixes were merged and released.
Of the 82 affected markers, Trail of Bits flagged a subgroup of 74 that could be minted without authorization. Those included bridged stablecoins, wrapped assets, consortium deposits, tokenized mortgage participations, and yield tokens — examples being uusd.trading, uusdc.figure.se, nbtc.figure.se, cusd.deposit, cguaranteedrateomni, chomebridgeomni, nuva.ylds, and uylds.fcc.
One striking stat: the combined nhash escrow in the affected markers was about 30 quadrillion nhash, which was roughly valued at $500,000 when the flaw was found. Most of that stash was concentrated in three accounts: grant0051 (~19.23 quadrillion nhash), provenance.validator.incentive.program (~8.56 quadrillion), and grant0077 (~2.49 quadrillion).
The risks varied by token type. Unrestricted coin-type markers were exposed to direct inflation (yep, free money for attackers). Restricted tokens with identity or transfer controls faced threats to supply integrity and solvency even if newly minted units couldn’t freely move around.
The disclosure doesn’t say whether anyone actually exploited the bug on-chain, nor whether affected issuers and users were individually notified. Bottom line: the hole existed, it was patched, and if you were running or relying on a Provenance marker back then, you had every reason to pay attention.
Final note: this was one of those bugs that felt like a logic prank — zeros behaving badly. The fixes brought the checks back in line with reality, but it’s a reminder that small mismatches between records can lead to surprisingly big messes.
