{"vulnerability": "ghsa-j496-crgh-34mx", "sightings": [{"uuid": "5d0623b7-a864-4124-ad90-f1141e63a732", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-j496-crgh-34mx", "type": "seen", "source": "https://gist.github.com/blessingblockchain/45445c4e5d457c9c5d721a5fc93ad073", "content": "# IBC Channel Spoof / Fake-Deposit Audit Targets\n\n> Secret Network Axelar exploit (Jun 2026, ~$4.67M): attacker opened a fake Cosmos chain + IBC channel, sent forged deposit packets with mimicked denoms (axlUSDC etc.), Secret's modified ICS-20 wrapper minted unbacked saTokens without verifying source channel, then redeemed via legitimate Axelar route.\n\n**Search date:** 2026-06-20  \n**Sources:** GitHub code search, chain node repos, Common Prefix / Axelar post-mortem, `scrtlabs/ics20-for-axelar` source review\n\n---\n\n## TIER 1 \u2014 Exact Secret bug class\n\nFlat-denom allowlist + inbound mint, **no Axelar channel pin**.\n\n### Confirmed deployed + exploited\n\n| Project / Chain | Repo | Mainnet evidence | Risk |\n|-----------------|------|------------------|------|\n| **Secret Network** | https://github.com/scrtlabs/ics20-for-axelar | `secret1yxjmepvyl2c25vnt53cr2dpn8amknwausxee83` (code ID 872/2446) | **EXPLOITED ~$4.67M** |\n| **Secret Network** (related) | Same family | `secret1nvytjz7t5wakf0ra5y47dfenatwxpggmkwc5ru`, `secret1e2lwttdwnpxpg6hudplfl54pdx4404nm54mj8r` | Same incident, related gateways |\n\n**Smoking gun** (`ics20-for-axelar` `ibc.rs`):\n- Inbound: `check_allow_list(deps, &denom)` on flat denom string\n- Then `mint_amount(...)` to SNIP20/CW20\n- No check that `packet.dest.channel_id` == authorized Axelar channel\n- No check counterparty is `axelar-dojo-1`\n- `ibc_channel_connect` accepts any channel opened to the contract port\n\n**GitHub search:** Only one repo exists \u2014 `scrtlabs/ics20-for-axelar`. No other chain deployments found.\n\n---\n\n## TIER 1B \u2014 Same family, different inbound logic (still audit)\n\n| Project | Repo | Inbound behavior vs Secret |\n|---------|------|---------------------------|\n| **Secret / Shade lineage** | https://github.com/securesecrets/ics20-proxy | `parse_voucher_denom()` against `packet.src` \u2014 expects `port/channel/denom` |\n| **Secret** | https://github.com/scrtlabs/snip20-ics20 | Fork of `ics20-proxy`; outbound SNIP20\u2192IBC |\n| **Shade Protocol** | https://github.com/securesecrets/shade | Bridge + Shade Wrap (Axelar \u2192 private SNIP20s) on Secret |\n\nShade bridge chains: Secret, Osmosis, Cosmos Hub, Stride, Comdex, Axelar, Agoric, Kujira, Juno, Stargaze, Akash, etc.\n\n---\n\n## TIER 2 \u2014 ibc-hooks auto-wrap (`WrapDeposit` \u2192 mint/wrap on IBC arrival)\n\n| Project / Chain | Repo |\n|-----------------|------|\n| **Secret Network** | https://github.com/scrtlabs/ibc-hooks-snip20-auto-wrap-proxy-contract |\n| **Secret Network** | https://github.com/scrtlabs/SecretNetwork (`x/ibc-hooks/`) |\n| **Secret** (examples) | https://github.com/scrtlabs/examples (IBC-wasm-hooks-tutorial) |\n| **Secret** (community) | `writersblockchain/secret-ibc` |\n\n### Chains with `x/ibc-hooks` in node repo\n\n| Chain | Repo |\n|-------|------|\n| **Osmosis** | https://github.com/osmosis-labs/osmosis |\n| **Neutron** | https://github.com/neutron-org/neutron |\n| **Secret Network** | https://github.com/scrtlabs/SecretNetwork |\n| **Picasso (Composable)** | https://github.com/ComposableFi/picasso |\n| **Initia** | https://github.com/initia-labs/initia |\n| **Merlin** | https://github.com/MerlinsLair/merlin |\n\nAlso: **Provenance** (`x/ibchooks/v2`), **Wormchain**, **DeltaSwap chain**, **Injective** (ibc-hooks test helpers).\n\n---\n\n## TIER 3 \u2014 Modified inbound-mint ICS-20 (not stock `ibctransfer`)\n\n| Project / Chain | Repo | Channel check? |\n|-----------------|------|----------------|\n| **Oraichain** | https://github.com/oraidex/ibc-bridge-wasm (`cw-ics20-latest`) | Per-channel mapping key; still mint-burn \u2014 audit redemption |\n| **BIG Gate** | https://github.com/BIG-Labs/gate-contract-core | `get_chain_and_channel_info_from_registered_channel` |\n| **Side Protocol** | https://github.com/sideprotocol/mesh-liquidity-wasm | `mint_tokens_cw20` in IBC handler \u2014 audit registration |\n| **Exora Layer** | https://github.com/exoralayer/contracts | Custom `ibc_packet_receive` |\n| **GGX Chain** | https://github.com/ggxchain/ibc | `ics20demo` mint on receive (likely demo) |\n| **Disperze / Osmosis** | https://github.com/disperze/cw-osmo | IBC receive handlers |\n| **Osmosis swap** | https://github.com/giansalex/cw-osmo-swap | IBC receive handlers |\n\n---\n\n## TIER 4 \u2014 Privacy / encrypted Cosmos\n\n| Network | Repo |\n|---------|------|\n| **Secret Network** | Exploited; txs encrypted |\n| **Penumbra** | https://github.com/penumbra-zone/penumbra |\n| **Namada** | https://github.com/anoma/namada |\n| **Anoma** | https://github.com/anoma/anoma (pre-mainnet) |\n| **DarkFi** | https://github.com/darkrenaissance/darkfi |\n\n---\n\n## TIER 5 \u2014 Axelar IBC + CosmWasm + GMP custom receivers\n\nVerify **channel ID + `DeriveIntermediateSender`** in every custom deposit/GMP contract.\n\nGMP account: `axelar1dv4u5k73pzqrxlzujxg3qp8kvc3pje7jtdvu72npnt5zhq05ejcsn5qme5`  \nReference: https://github.com/axelarnetwork/evm-cosmos-gmp-sample\n\n| Network | Why listed |\n|---------|------------|\n| **Osmosis** | Highest Axelar volume; ibc-hooks; GMP apps |\n| **Neutron** | CosmWasm + ibc-hooks + GMP |\n| **Injective** | CosmWasm + cross-chain DeFi |\n| **Sei** | CosmWasm + EVM; Axelar connected |\n| **dYdX** | Cosmos appchain; Axelar connected |\n| **Celestia** | Via Axelar IBC |\n| **Juno** | CosmWasm |\n| **Stargaze** | CosmWasm NFT/cross-chain |\n| **Archway** | CosmWasm |\n| **Migaloo** | CosmWasm |\n| **Kujira** | DeFi + IBC |\n| **Persistence** | Axelar GMP (Sommelier ecosystem) |\n| **Sommelier** | Axelar GMP explicitly |\n| **Evmos** | IBC-heavy |\n| **Terra 2** | IBC + CosmWasm |\n| **Noble** | USDC IBC hub |\n| **Akash** | Cosmos SDK + IBC |\n| **Fetch.ai / ASI** | Cosmos SDK + IBC |\n| **Carbon** | DeFi chain |\n| **Comdex** | DeFi + IBC |\n| **Cosmos Hub** | IBC hub |\n\n---\n\n## TIER 6 \u2014 Related bug class (ibc-hooks reentrancy infinite mint)\n\n**ASA-2024-007** / Asymmetric Research advisory (Apr 2024)\n\n**Profile:** CosmWasm + ibc-hooks wrapping ICS-20 + unpatched ibc-go\n\nOverlaps Tier 2 chains: Osmosis, Neutron, Secret, Initia, Picasso, Merlin, Provenance, etc. \u2014 verify patched ibc-go.\n\n- https://github.com/cosmos/ibc-go/security/advisories/GHSA-j496-crgh-34mx\n- https://github.com/asymmetric-research/security-advisories/blob/main/advisories/2024-04-16_cosmos_ibc-reentrancy-infinite-mint.md\n\n---\n\n## Lower risk for this specific Secret attack\n\n| Category | Why |\n|----------|-----|\n| Chains using only native `x/transfer` for Axelar assets | Vouchers are `ibc/HASH` per channel |\n| Pure EVM Axelar gateway chains | `validateContractCall()` on gateway |\n| Osmosis as exit venue | Attacker cashed out through Osmosis; not the mint bug |\n\n---\n\n## Priority audit queue\n\n| Priority | Target | Action |\n|----------|--------|--------|\n| **P0** | Secret Network | `ics20-for-axelar`, `ibc-hooks-snip20-auto-wrap-proxy`, Shade bridge/wrap, related contract addresses |\n| **P1** | Secret mainnet | Scan for clones of codehash `2976a2577999168b89021ecb2e09c121737696f71c4342f9a922ce8654e98662` |\n| **P1** | Osmosis, Neutron, Injective, Sei, Juno | Grep Wasm ibc-hooks targets for missing channel allowlist on mint/wrap |\n| **P2** | Shade Protocol (Secret) | Axelar \u2192 SNIP20 wrap path |\n| **P2** | Oraichain (`oraidex/ibc-bridge-wasm`) | Per-channel mint-burn + pool redemption |\n| **P2** | Penumbra, Namada | Shielded IBC deposit semantics |\n| **P3** | Picasso, Initia, Merlin, Provenance, Side, Exora | ibc-hooks + custom IBC mint handlers |\n\n---\n\n## Grep signatures\n\n```rust\n// RED \u2014 Secret-class bug\nibc_packet_receive + check_allow_list + mint_amount\n// without: packet.dest.channel_id == EXPECTED_AXELAR_CHANNEL\n\n// RED \u2014 hooks wrap without channel pin\nWrapDeposit + ibc-hooks\n// without: channel allowlist or DeriveIntermediateSender check\n\n// GREEN \u2014 good patterns\nparse_voucher_denom(..., &packet.src)\nget_chain_and_channel_info_from_registered_channel(...)\nDeriveIntermediateSender(channel, AXELAR_GMP_ACCOUNT, prefix)\n```\n\n---\n\n## Summary\n\n- **Exact dangerous fork (`ics20-for-axelar`):** deployed on **Secret Network only** (confirmed exploited).\n- **Broader blast radius:** any chain with **ibc-hooks auto-wrap** or **custom inbound IBC mint** without pinning to real Axelar channel.\n- **Top audit targets:** Secret (remaining contracts), Osmosis, Neutron, Injective, Sei, Juno, Shade, Oraichain, Penumbra, Namada.\n", "creation_timestamp": "2026-06-20T15:24:39.000000Z"}]}