ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 8.0.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and MsgWithdrawShare, as well as the batch order processor. Because any account may list an arbitrary blockchainAccountID as a verification method on a DID it controls (without the consent of that address's owner), an attacker could register victims' addresses as verification methods on their own DID and then move the victims' balances into a bond the attacker controlled — later withdrawing and bridging the proceeds off-chain. This was exploited on ixo mainnet (ixo-5) on 2026-06-20. The attack required no victim keys, signatures, or system compromise — any account holding a balance in a token a bond could use was at risk. This was fixed in v8.0.0, delivered via the on-chain v8 software-upgrade. The x/bonds module is disabled: every bonds message is rejected on all routes (top-level, authz, CosmWasm, and ICA), and the bonds batch EndBlocker is a no-op so no further reserve movements can occur. All node operators and validators must upgrade to v8.0.0. The flaw is in chain state-machine logic and can only be remediated by running the patched binary. There is no application-level workaround. The vulnerability is in consensus logic; remediation requires the network to run the patched (v8.0.0) binary. The bonds module remains disabled in v8.0.0 and will only be re-enabled in a future release once the signer-authorization model has been corrected.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- ixofoundation ixo-blockchain
fixed in 8.0.0
- github.com/ixofoundation/ixo-blockchain/v8Go
fixed in 8.0.0
- github.com/ixofoundation/ixo-blockchain/v7Go
through 7.0.0
- github.com/ixofoundation/ixo-blockchain/v6Go
through 6.0.1
- github.com/ixofoundation/ixo-blockchain/v5Go
through 5.0.0
- github.com/ixofoundation/ixo-blockchain/v4Go
through 4.0.0
- github.com/ixofoundation/ixo-blockchain/v3Go
through 3.0.0
- github.com/ixofoundation/ixo-blockchainGo
through 1.6.0
- github.com/ixofoundation/ixo-blockchainGo
All versions
- github.com/ixofoundation/ixo-blockchain/v3Go
All versions
- github.com/ixofoundation/ixo-blockchain/v4Go
All versions
- github.com/ixofoundation/ixo-blockchain/v5Go
All versions
- github.com/ixofoundation/ixo-blockchain/v6Go
All versions
- github.com/ixofoundation/ixo-blockchain/v7Go
All versions