Skip to content

axelar

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

axelar

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
README.md
README.md
 
 
axelar.t.sol
axelar.t.sol
 
 

README.md

LumosKit Run Report — ethereum 0x3513509c…ca8e05

Deterministic final report assembled from existing LumosKit outputs; this finalize step does not call an agent.

Case overview

  • Chain: ethereum (chain_id=1)
  • Tx hash: 0x3513509c71bc8e02695fad55e136b8f21933f6a4433f4dafe471800d98ca8e05
  • Block: 25289192
  • Final quality: partial
  • Product/PoC gate: pass
  • Final-quality basis: poc_and_rca
  • Final-quality reason: Verified economic PoC, but RCA is partial.
  • Elapsed: 570.84s (570842 ms)
  • Finding: Current transaction consumes a pre-existing Axelar mint approval and drains WETH, but approval provenance is missing

Signal context

  • Protocol claim: Axelar
  • Detector source: hack-detector:twitter:GoPlusZH
  • Detected at: 2026-06-20T08:31:29+00:00
  • Published at: 2026-06-20T08:31:29+00:00
  • Original alert: https://x.com/GoPlusZH/status/2068250371102064655
  • Source id: tw:2068250371102064655
  • Lumos signal id: 09d6b5d4-51ae-4b49-b148-1f633cceae8c
  • Incident group id: 16c35e55-87a3-472a-8aa0-ba15bf609d3d
  • Claimed loss: 4670000

Detector summary:

Axelar assets worth $4.67M stolen via an infinite minting exploit on Secret Network's CW20-ICS20 contract.

Pipeline timing

  • Orchestrator wall time: 258.39s (258390 ms)

  • Current stage-duration sum: 570.84s (570842 ms)

Stage Artifact Duration Status
cefg cefg 68.06s (68065 ms) success
localize localize 13 ms success
lift lift 87 ms success
flow_context flow_context 1.03s (1031 ms) success
enrich enrich 4.09s (4087 ms) success
semantic semantic 269 ms success
context_pack context_pack 34 ms success
asset_delta asset_delta 29 ms success
poc_sketch poc_sketch 61 ms success
agent_poc agent_poc 238.78s (238775 ms) success
rca rca 258.39s (258391 ms) success

Reproduction quality

  • PoC status: verified
  • Forge fmt: pass
  • Forge build: pass
  • Forge test: pass
  • Proof kind: economic_proof
  • RCA status: partial / partial
  • RCA confidence: low

Economic reproduction

  • Basis: holder-net USD loss
  • Verdict: exact — PoC reproduces 99–101% of incident net loss.
  • Incident net loss: $364151.05
  • PoC net reproduced: $364151.05
  • USD ratio: 1.000x

Attack narrative

Attack Flow

Generated by agent_poc from deterministic PoC handoff, verified Foundry execution, and economic reproduction artifacts.

Verification Gate

  • Status: pass
  • Execution status: pass
  • Economic status: pass
  • Proof kind: economic_proof
  • Forge build: pass
  • Forge test: pass

Replay Target

  • Transaction: 0x3513509c71bc8e02695fad55e136b8f21933f6a4433f4dafe471800d98ca8e05
  • Block: 25289192
  • Root call type: CALL
  • Target/tx.to: 0xb773bcc5b325ad9ac6b36e1a046ad4466833a16e
  • Attacker: 0x8dbee8f3917049bc30fef01924a7ac79d16cf2b9

Observed Trace Flow

  • Ordered by trace evidence line from full CEFG; use this to place PoC constructor, entry, callback, and fallback bodies.
  • [01] line=50 frame 1 attacker_entry:executeWithToken@0xb773…a16e --DELEGATECALL--> frame 2 delegate_context:executeWithToken@0xb773…a16e [localized_to_localized]
  • [02] line=729 frame 2 delegate_context:executeWithToken@0xb773…a16e --CALL--> frame 3 external:entry@0x4f44…56a5 [localized_to_external]
  • [03] line=3615 frame 2 delegate_context:executeWithToken@0xb773…a16e --STATICCALL--> frame 6 external:entry@0x4f44…56a5 [localized_to_external]
  • [04] line=4707 frame 2 delegate_context:executeWithToken@0xb773…a16e --CALL--> frame 8 external:entry@0xc02a…6cc2 [localized_to_external]

PoC Surfaces

Role Surface Selector Address Frames
attacker_entry executeWithToken(bytes32,string,string,bytes,string,uint256) 0x1a98b2e0 0xb773bcc5b325ad9ac6b36e1a046ad4466833a16e 1

Economic Effect

  • Reconciliation basis: incident_drain
  • Verdict: exact
  • Comparison basis: holder_net_usd_loss
Source Direction Holder Token Delta USD value
incident_drain loss 0x4f4495243837681061c4743b74b3eedf548d56a5 WETH -223.366721790776578348 $-364151.05

Multi-leg reconciliation

  • Status: pass
  • Basis: incident_drain
  • Source: agent_poc.economic_reproduction
  • Selected rows: 1
Source Direction Holder Role Token Delta USD value
incident_drain loss 0x4f4495243837681061c4743b74b3eedf548d56a5 storage_contract WETH -223.366721790776578348 $-364151.05

Root cause analysis

  • Title: Current transaction consumes a pre-existing Axelar mint approval and drains WETH, but approval provenance is missing
  • Severity: critical
  • Confidence: low
  • Violated invariant: Not proven from supplied artifacts; the candidate invariant would be that only an intended, source-authorized destination contract can consume a valid Axelar call-with-token approval for a given command/payload/token/amount.

Final root cause

The current transaction does not contain a source-supported, patchable root cause. It shows 0xb773bcc5b325ad9ac6b36e1a046ad4466833a16e calling AxelarGateway.validateContractCallAndMint with a command/source/payload/token/amount tuple for which the gateway approval key was already true; the gateway cleared that key and transferred WETH to msg.sender. The missing causal link is why that approval existed or why 0xb773... was allowed to consume it, because the approval-creation provenance and verified source for the caller-side executeWithToken logic are absent.

Affected contracts

Address Name Role Implementation
0xb773bcc5b325ad9ac6b36e1a046ad4466833a16e unknown source-gapped caller that consumed the Axelar approval and forwarded WETH 0xef1ce4489962e6d6d6be8066e160b2799610cb85
0x4f4495243837681061c4743b74b3eedf548d56a5 AxelarGatewayProxyMultisig gateway escrow and approval validator that transferred WETH after approval consumption 0x99b5fa03a5ea4315725c43346e55a6a6fbd94098

Recommended fixes

  • Do not patch from this current-transaction RCA alone; first recover the approval-creation transaction and verified source for 0xb773.../0xef1c... to identify whether the missing guard belongs in approval creation, destination binding, executor authorization, replay handling, or caller-side payload routing.
  • If the recovered evidence proves unauthorized approval consumption, enforce the invariant at the approval or consume point by binding command approvals to the intended destination contract/code path and rejecting consumption by unintended callers.

Limitations

  • prior_state_provenance_gap: the transaction consumes an existing Axelar call-with-token approval, but the artifact set does not include the transaction or governance/operator action that created that approval.
  • caller_source_gap: verified source for 0xb773bcc5b325ad9ac6b36e1a046ad4466833a16e and implementation/code address 0xef1ce4489962e6d6d6be8066e160b2799610cb85 is absent from artifacts/rca/victim_sources/.
  • tx_scope_gap: the decisive invariant-breaking state transition, if any, appears to be outside the supplied current-transaction frame set.
  • missing_assumption
  • effect_cause_confusion
  • PoC is verified, but closed-world artifacts do not include the approval-provenance evidence or verified caller source needed to identify a patchable root cause.

Artifacts

Artifact Bundle path Status
Bundle index README.md generated
Machine run summary report/run_summary.json generated
Final integrated report report/REPORT.md generated
RCA report/RCA.md included
RCA structured report report/report.json included
PoC poc/PoC.t.sol included
PoC base support poc/Base.sol included
Asset deltas evidence/asset_deltas.json included
Fund flows evidence/fund_flows.json included
Asset delta graph visuals/asset_deltas.png included
Fund-flow graph visuals/fund_flows.png included