Ixo Blockchain
Monthly
Authorization bypass in the ixo Blockchain x/bonds module (all versions before v8.0.0) lets any unauthenticated remote account move another user's token balance into an attacker-controlled bond by simply adding the victim's blockchain address as a verification method on a DID the attacker owns - no victim keys, signatures, consent, or prior system compromise are required. The flaw affects the MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap and MsgWithdrawShare handlers plus the bonds batch order processor and its EndBlocker, and the vendor advisory reports the technique was exploited on ixo mainnet (ixo-5) on 2026-06-20, with the proceeds later withdrawn and bridged off-chain. With a CVSS 9.3 rating, PR:N/UI:N reachability, and every account holding a balance in a bond-usable token in scope, this is a genuine top-priority issue rather than a high-score-but-low-real-risk case.
Authorization bypass in the ixo Blockchain x/bonds module (all versions before v8.0.0) lets any unauthenticated remote account move another user's token balance into an attacker-controlled bond by simply adding the victim's blockchain address as a verification method on a DID the attacker owns - no victim keys, signatures, consent, or prior system compromise are required. The flaw affects the MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap and MsgWithdrawShare handlers plus the bonds batch order processor and its EndBlocker, and the vendor advisory reports the technique was exploited on ixo mainnet (ixo-5) on 2026-06-20, with the proceeds later withdrawn and bridged off-chain. With a CVSS 9.3 rating, PR:N/UI:N reachability, and every account holding a balance in a bond-usable token in scope, this is a genuine top-priority issue rather than a high-score-but-low-real-risk case.