# State divergence enables unauthorized access

DevFeed: [State divergence enables unauthorized access](<https://devfeed.tech/articles/state-divergence-enables-unauthorized-access-7663.md>)

Original publisher: [Read original article](<https://blog.trailofbits.com/2026/08/25/state-divergence-enables-unauthorized-access/>)

Author: "Paweł Płatek"; "Denys Pakizh"

Published: 2026-08-25T11:00:00Z

Content type: article

Language: en

Sources: [The Trail of Bits Blog](<https://devfeed.tech/sources/the-trail-of-bits-blog.md>), [The Trail of Bits Blog](<https://devfeed.tech/sources/the-trail-of-bits-blog-2.md>)

Topics: [bug](<https://devfeed.tech/topics/bug.md>), [Blockchain](<https://devfeed.tech/topics/blockchain.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Transactions](<https://devfeed.tech/topics/transactions.md>), [SDKs](<https://devfeed.tech/topics/sdks.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [access-control](<https://devfeed.tech/tags/access-control.md>), [audits](<https://devfeed.tech/tags/audits.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [blockchain](<https://devfeed.tech/tags/blockchain.md>), [bug](<https://devfeed.tech/tags/bug.md>), [financial-services](<https://devfeed.tech/tags/financial-services.md>), [module](<https://devfeed.tech/tags/module.md>), [tokens](<https://devfeed.tech/tags/tokens.md>), [transactions](<https://devfeed.tech/tags/transactions.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

The article describes a Provenance Blockchain authorization bug that allowed users to grant themselves admin control over marker accounts without holding tokens. The flaw affected non-fixed-supply markers because the access check read a stale zero-valued supply field instead of the live circulating supply. The issue was mitigated in v1.28.0 and fixed in v1.29.0.

## Source excerpt

We found and reported a bug in Provenance Blockchain, a public proof-of-stake chain built on Cosmos SDK, that lets any user grant themselves admin control over marker accounts without holding a single token. Provenance covers a range of financial services, including on-chain tokenized loans, private equity tokens, bridged assets, and asset registries. Our bug affected 82 markers representing live financial assets on mainnet. We found the bug, which affects versions before 1.28.0, in March 2026, and reported it to Provenance on April 1. It was mitigated in PR #2627 (commit c81fd65), which shipped in v1.28.0 on May 1, 2026, and fixed in PR #2734, which shipped in v1.29.0 on June 8, 2026. What is a marker? The marker module is Provenance's core primitive for fungible tokens. Chain participants can issue a new asset on Provenance by submitting a MsgAddMarkerRequest transaction; the chain creates a dedicated account for that asset, called a marker. Each marker is a special account type that controls: A denomination (e.g., uusd.trading, cusd.deposit, cguaranteedrateomni) An access control list governing who can mint, burn, withdraw, deposit, or administer the token A supply field recording the canonical token count An escrow balance (the marker account can hold any asset, not just its own denomination) Markers are either supply_fixed (the supply field is enforced as a hard cap) or non-fixed (the bank module is the source of truth; the supply field is informational). This distinction is central to the bug. The bug: An access check anyone can pass AddAccess is the Cosmos SDK message handler that processes requests to modify a marker's access control list. It checks whether the caller is authorized using three conditions, any one of which is sufficient: The caller is the marker's designated manager and the marker is in Finalized state. The caller already holds ACCESS_ADMIN on the marker. The caller controls 100% of the marker's circulating supply. case types.StatusFinalized,