Summary
A critical vulnerability exists in the EVM precompile modules for x/bank and x/ica on the Cronos chain. This flaw potentially allows:
- Unauthorized Token Minting: Bypassing module-level authorization checks.
- Interchain Account (ICA) Takeover: Compromising ICA accounts via crafted cross-chain packets.
- Result: Direct fund theft and potential token inflation.
The core issue stems from insufficient ownership validation within the EVM precompile entry points when invoked indirectly via IBC packet handlers. Specifically, there appears to be a lack of checks ensuring msg.sender corresponds to the authorized owner or delegate for sensitive operations.
Details
- Component: EVM Precompiles (
bank, ica)
- Location: Likely in
/precompiles/bank/ and /precompiles/ica/ directories or equivalent.
- Mechanism:
- An attacker crafts a specific IBC packet destined for the Cronos chain.
- This packet triggers an IBC packet handler (e.g., in
x/ica).
- The handler subsequently calls into the EVM precompile (e.g.,
BankPrecompile.Transfer or ICAPrecompile.Call).
- Due to missing validation (e.g.,
msg.sender == owner or authz checks), the precompile executes sensitive operations (like token transfers or arbitrary calls on behalf of the ICA owner) without proper authorization.
- Impact:
- An attacker could mint arbitrary tokens if the
bank precompile is involved in minting functions.
- An attacker could execute unauthorized transactions from an ICA account, potentially draining its funds or altering its state.
Previous Disclosure
This issue was previously reported to Crypto.com via HackerOne (Report #3595710, submitted Mar 10, 2026) under the username rdin777. Crypto.com confirmed the issue is out of scope for their program and recommended contacting the Cronos team directly. Multiple attempts to contact the Cronos security team via security@cronos.org have received no response as of yet.
References
- HackerOne Report: #3595710 (Status: Informative - Out of Scope for Crypto.com)
- Related Research: DeFi Security Blueprint - Case Studies (See "Cronos ICA Precompile Issue (March 2026, Out of Scope)" section added for transparency regarding the disclosure attempt).
Recommendation
Please investigate this issue urgently. If confirmed, immediate patching and coordination for a network upgrade will be necessary to mitigate the risk. I am available to provide further technical details or a Proof of Concept if directed to a secure communication channel by the Cronos team.
Labels
security, critical, precompile, ica, bank, ibc
Summary
A critical vulnerability exists in the EVM precompile modules for
x/bankandx/icaon the Cronos chain. This flaw potentially allows:The core issue stems from insufficient ownership validation within the EVM precompile entry points when invoked indirectly via IBC packet handlers. Specifically, there appears to be a lack of checks ensuring
msg.sendercorresponds to the authorized owner or delegate for sensitive operations.Details
bank,ica)/precompiles/bank/and/precompiles/ica/directories or equivalent.x/ica).BankPrecompile.TransferorICAPrecompile.Call).msg.sender == ownerorauthzchecks), the precompile executes sensitive operations (like token transfers or arbitrary calls on behalf of the ICA owner) without proper authorization.bankprecompile is involved in minting functions.Previous Disclosure
This issue was previously reported to Crypto.com via HackerOne (Report #3595710, submitted Mar 10, 2026) under the username
rdin777. Crypto.com confirmed the issue is out of scope for their program and recommended contacting the Cronos team directly. Multiple attempts to contact the Cronos security team viasecurity@cronos.orghave received no response as of yet.References
Recommendation
Please investigate this issue urgently. If confirmed, immediate patching and coordination for a network upgrade will be necessary to mitigate the risk. I am available to provide further technical details or a Proof of Concept if directed to a secure communication channel by the Cronos team.
Labels
security,critical,precompile,ica,bank,ibc