Critical Bug Fixed in Circle’s Noble-CCTP

August 28, 2024 04:30 PM AEST | By Team Kalkine Media

Google News:

Critical Bug Fixed in Circle’s Noble-CCTP — Image source: shutterstock

Recent News

Caterpillar’s E&T segment is likely a core driver to the next EPS cycl...

Ro& by Armatec Global Appoints Former U.S. Air Force Lieutenant Genera...

Entergy Recognized as Civic 50 Honoree for the 10th Consecutive Year

Riot Platforms: Needham sees ’major opportunity’ in Corsicana

On August 27, Asymmetric Research, a blockchain security firm, disclosed a critical vulnerability in Circle's Noble-Cross Chain Transfer Protocol (CCTP) used for USDC transactions on the Cosmos network. The flaw was identified in the "ReceiveMessage" handler of Noble-CCTP, which was allowing unauthorized “BurnMessages” from any sender, bypassing the required verification checks for the original chain’s “TokenMessenger” address.

The vulnerability could have enabled a malicious actor to mint counterfeit (USDC) tokens on the Noble bridge. Although the issue initially appeared to be an infinite mint glitch, it was mitigated by Noble’s enforcement of a minting limit of approximately 35 million USDC. Asymmetric Research reported that no funds were lost, and no attacks were executed using this vulnerability. Circle has since corrected the software flaw.

This incident highlights broader concerns about cross-chain bridge security. Earlier in May 2024, a similar vulnerability was discovered in the Wormhole bridge on the Aptos network by CertiK, another blockchain security firm. The identified weakness could have led to a $5 million exploit, but it was resolved before any damage occurred. The Wormhole bridge had previously faced a severe security breach in 2022, resulting in a $321 million loss due to unauthorized token minting.

The critical vulnerability in Noble-CCTP reinforces the importance of rigorous security measures for blockchain infrastructure. Asymmetric Research's timely disclosure and Circle’s prompt remediation of the issue are crucial steps in safeguarding the USDC ecosystem.

Moreover, a recent report from ImmuneFi indicates that nearly 80% of cryptocurrencies that have experienced hacks or exploits do not recover in price. This statistic underscores the significant impact security breaches can have on cryptocurrency value and the necessity for continuous vigilance and robust security protocols in the blockchain industry.

Disclaimer

The content, including but not limited to any articles, news, quotes, information, data, text, reports, ratings, opinions, images, photos, graphics, graphs, charts, animations and video (Content) is a service of Kalkine Media Pty Ltd (Kalkine Media, we or us), ACN 629 651 672 and is available for personal and non-commercial use only. The principal purpose of the Content is to educate and inform. The Content does not contain or imply any recommendation or opinion intended to influence your financial decisions and must not be relied upon by you as such. Some of the Content on this website may be sponsored/non-sponsored, as applicable, but is NOT a solicitation or recommendation to buy, sell or hold the stocks of the company(s) or engage in any investment activity under discussion. Kalkine Media is neither licensed nor qualified to provide investment advice through this platform. Users should make their own enquiries about any investments and Kalkine Media strongly suggests the users to seek advice from a financial adviser, stockbroker or other professional (including taxation and legal advice), as necessary. Kalkine Media hereby disclaims any and all the liabilities to any user for any direct, indirect, implied, punitive, special, incidental or other consequential damages arising from any use of the Content on this website, which is provided without warranties. The views expressed in the Content by the guests, if any, are their own and do not necessarily represent the views or opinions of Kalkine Media. Some of the images/music that may be used on this website are copyright to their respective owner(s). Kalkine Media does not claim ownership of any of the pictures displayed/music used on this website unless stated otherwise. The images/music that may be used on this website are taken from various sources on the internet, including paid subscriptions or are believed to be in public domain. We have used reasonable efforts to accredit the source wherever it was indicated as or found to be necessary.