🚨 We analyzed a CRITICAL vulnerability in $PORT3
A perfect storm of 3 bugs allowed attackers to:
✓ Bypass authorization with EMPTY signatures
✓ Register fake chains
✓ Mint UNLIMITED tokens
✓ Drain bridge liquidity
The root cause? Owner = 0x0
What happened 🧵
With fake chain registered:
tokenContracts[23] = 0x4644bbcfd26... // Attacker's contract
Now attacker can:
Forge Wormhole message from "chain 23"
Set emitter = their contract
Set amount = UNLIMITED
Call bridgeIn()
Contract mints tokens ✓
FUNDS DRAINED
The Attack Transaction
Here's the actual exploit transaction: bscscan.com/tx/0xe3391f44469…
Attacker calls with:
Valid custodian (themselves)
Valid timestamp
INVALID signature (all zeros)
Transaction succeeds 🔥
Bug #2 - Empty Signature Acceptance
Result: Attacker sends 65 bytes of zeros → Accepted
Critical bug: Signature verification doesn't check for zero address
Here's the trap:
Invalid signatures return 0x0 from ecrecover
If authority = 0x0
Then: 0x0 == 0x0 → TRUE ✗
Authorization BYPASSED with invalid signature
When a non-owner wants to call sensitive functions, they must provide:
✓ Valid custodian address
✓ Non-expired timestamp
✓ VALID SIGNATURE
CATERC20 is a cross-chain token bridge using:
Wormhole for cross-chain messaging
Signature verification for governance
registerChains() to whitelist token bridges
Problem: The authorization mechanism had a critical flaw.
Phạm Tiến Minh Đức retweeted
Do you want to make consistent profits each month?
Participate to win a lifetime subscription to @Bheem_Lounge worth $1500.
Still not enough? Win an additional $1000 in USDT by becoming a ByBit user: forms.gle/Ur4Jd6GcEBoZTvDj6
❤️ & ♻️ to enter !!
Phạm Tiến Minh Đức retweeted
Our previous tweet got botted therefore we’re redrawing the giveaway.
1. Follow @Bheem_Lounge
2. Like & Retweet this post
3. Join our discord (link in bio)
Subscription worth $1200, drawn in 24 hours📣
