Wormhole

Aptos

USDC

Security

Cosmos

On Aug. 27, Asymmetric Research revealed it identified a critical bug in Circle’s Noble-CCTP, a component of the USDC (<a data-ct-non-breakable="null" href="https://cointelegraph.com/usdc-price-index" rel="null" target="null" text="null">USDC</a>) Cross-Chain Transfer Protocol,&nbsp;on the Cosmos network.
According to the Web3 security firm, a malicious actor could have potentially sidestepped the cross-chain transfer protocol’s message sender verification process to mint fake USDC tokens on the Noble bridge.
More specifically, the Noble-CCTP “ReceiveMessage” handler was accepting “BurnMessages” from any sender without first checking that the bridging message was sent from a verified “TokenMessenger” address on the original chain. The security firm outlined the vulnerability in greater detail:
<blockquote>
 "An attacker could have been able to exploit this and trigger malicious USDC mints by sending a fake BurnMessage directly through a CCTP MessageTransmitter contract, using the Noble-CCTP module address and Noble’s chain—ID as the CCTP destination."
</blockquote>
Asymmetric Research explained that the problem initially appeared to be an infinite mint glitch but could not have been due to Noble’s enforcement of a mint limit of approximately 35 million USDC.
<figure>
 <img alt="Critical bug identified and remedied in Circle’s Noble-CCTP" name="" src="https://s3.cointelegraph.com/uploads/2024-08/019195d1-d050-75c8-86ea-eac5cd7e644d">
 <figcaption style="text-align: center;">
 A graphic explaining the different components of CCTP. Source: <a data-ct-non-breakable="null" href="https://www.asymmetric.re/blog/circles-cctp-noble-mint-bug" rel="nofollow noopener" target="_blank" text="null">Asymmetric Research</a>
 </figcaption>
</figure>
The Web3 security firm concluded by noting that no users lost funds and no malicious actors were able to successfully leverage the vulnerability and launch an attack. At the time of this writing, Circle has remedied the software bug.
Related:<a data-ct-non-breakable="null" href="https://cointelegraph.com/news/circle-proposes-new-capital-risk-framework-stablecoins" rel="null" target="null" text="null"> Circle proposes new capital-risk framework for stablecoins</a>
<h2 id="circle-s-noble-cross-chain-bridge-isn-t-the-only-one">Circle’s Noble cross-chain bridge isn’t the only one</h2>
In May 2024, <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/certik-discovered-5-million-security-flaw-wormhole-bridge-aptos" rel="null" target="null" text="null">a similar vulnerability</a> was identified in the Wormhole bridge on the Aptos network. CertiK—another blockchain security firm—discovered the weakness that would have resulted in a $5 million exploit had the vulnerability not been identified and addressed.
The Wormhole critical vulnerability was caused by a problem with the “publish_event” function, allowing anyone to call the contract and mint fake tokens.
However, Wormhole has not always been so lucky when it comes to proactively addressing vulnerabilities. In 2022, the bridging protocol <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/wormhole-token-bridge-loses-321m-in-largest-hack-so-far-in-2022" rel="null" target="null" text="null">lost $321 million</a> in a high-profile exploit allowing a user to mint fake tokens.
<h3 id="nearly-80-of-hacked-cryptocurrencies-don-t-recover-in-price">Nearly 80% of hacked cryptocurrencies don’t recover in price</h3>
Asymmetric Research’s discovery of the critical vulnerability bodes well for Circle’s USDC, which may have suffered consequences resulting from a malicious actor taking advantage of the vulnerability.
A recent report from Immunefi shared with Cointelegraph revealed that nearly 80% of hacked or exploited cryptocurrencies <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/crypto-hacks-price-declines-report-2024" rel="null" target="null" text="null">never recover</a> in terms of price.
Magazine:<a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/ivest-hacked-sinkclose-affects-amd-devices-usdt-phishing/" rel="null" target="null" text="null"> Weird ‘null address’ iVest hack, millions of PCs still vulnerable to ‘Sinkclose’ malware: Crypto-Sec</a>

Critical bug identified and remedied in Circle’s Noble-CCTP

Table of Contents

Cointelegraph

Other articles published on Aug 27, 2024

AI vs. human leadership: Debate over plan to govern Cheyenne with AI

Stablecoin Market Shatters Records, Surges to Unprecedented $168B After Year-Long Rally

Hong Kong’s Crypto Embrace: From Green Bonds to Spot Bitcoin ETFs

Analysts Anticipate Nvidia’s Upcoming Earnings Report

Floki Becomes Official Partner of Nottingham Forest for Premier League 2024/2025 Season

American Woodmark Corporation Reports 7.9% Decline in Q1 Net Sales

Join our free newsletter for daily crypto updates!