GHSA-w3rp-4cm2-4wgc: Go/github.com/ixofoundation/ixo-blockchain vulnerability
Impact
Type: Improper authorization leading to unauthorized movement of user funds.
The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and MsgWithdrawShare, as well as the batch order processor.
Because any account may list an arbitrary blockchainAccountID as a verification method on a DID it controls (without the consent of that address's owner), an attacker could register victims' addresses as verification methods on their own DID and then move the victims' balances into a bond the attacker controlled — later withdrawing and bridging the proceeds off-chain.
This was exploited on ixo mainnet (ixo-5) on 2026-06-20. The attack required no victim keys, signatures, or system compromise — any account holding a balance in a token a bond could use was at risk.
Patches
Fixed in v8.0.0, delivered via the on-chain v8 software-upgrade. The x/bonds module is disabled: every bonds message is rejected on all routes (top-level, authz, CosmWasm, and ICA), and the bonds batch EndBlocker is a no-op so no further reserve movements can occur.
All node operators and validators must upgrade to v8.0.0. The flaw is in chain state-machine logic and can only be remediated by running the patched binary.
Workarounds
There is no application-level workaround. The vulnerability is in consensus logic; remediation requires the network to run the patched (v8.0.0) binary. The bonds module remains disabled in v8.0.0 and will only be re-enabled in a future release once the signer-authorization model has been corrected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/ixofoundation/ixo-blockchain/v8to a version that resolves this vulnerability.Fixed in 8.0.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v8.0.0Patch on-chain v8 software-upgrade - Configuration
Keep the x/bonds module disabled; reject all bonds messages on top-level, authz, CosmWasm, and ICA routes, and keep the bonds batch EndBlocker as a no-op.
x/bonds module module status = disabled
Event History
Frequently Asked Questions
Who was exposed to unauthorized fund movement?
Any account holding a balance in a token that a bond could use was at risk. An attacker did not need the victim's keys, signatures, or access to the underlying system.
Which transaction paths were affected?
Affected bond handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and MsgWithdrawShare, along with the batch order processor. The issue also applied to movements initiated through the vulnerable bonds functionality rather than requiring a direct victim transaction.
What is the current mitigation if an upgrade cannot be completed immediately?
The documented fix is v8.0.0, delivered through the on-chain v8 software upgrade. In that version, the x/bonds module is disabled: all bonds messages are rejected through top-level, authz, CosmWasm, and ICA routes, and its batch EndBlocker does nothing.
Was this issue exploited in practice?
Yes. It was exploited on ixo mainnet (ixo-5) on 2026-06-20.