Home›Crypto›Market Structure›TAC blockchain stays frozen after exploit drains bonde…

TAC blockchain stays frozen after exploit drains bonded staking pool

TAC said a proposed state edit would replace 1.258 billion TAC from foundation treasury reserves without rolling back 7,772 transactions.

Reported · Written up by our desk · Market Structure

TAC’s blockchain remains halted at block 24,671,475 more than 10 days after an exploit drained the network’s bonded staking pool, leaving normal block production unrestarted, according to CryptoSlate. CryptoSlate reports that TAC’s Sept. 1 postmortem attributed the drain to 2,985,651,403.40 TAC, or 28.6% of total supply, with one transaction reducing the bonded pool to zero while total token supply stayed unchanged and delegation records lacked tokens that should have backed them. The outlet says an EVM-related advisory linked the attack path to a mismatch between two balance records, where the EVM StateDB tracked only spendable tokens while the Cosmos SDK ledger also tracked locked vesting tokens that could be delegated. It adds that delegating more than the spendable amount triggered an overflow that then allowed an attacker to zero a victim account while retaining legitimate tokens, with the protocol-controlled staking pool identified as the victim account on TAC. CryptoSlate also details that Cosmos Labs said the underlying bug reached its bounty program on April 25, was patched on the main branch May 15, and was backported into releases on Aug. 19, with upstream guidance classing the flaw as critical for specific Cosmos EVM versions. TAC said it proposed recovery by removing 65,100,989 incident-linked frozen TAC on TAC, handling 1,662,322,353 TAC tied to incident-associated BNB Chain addresses separately, and replacing 1,258,228,061.40 TAC from TAC Foundation treasury reserves, aiming to restore the bonded pool and delegator balances while preserving 7,772 legitimate transactions from 218 unique validators.

Latest closeBNB $692.19 ▲1.4%

More like this

Sources