Axelar responds to security incident: Axelar and IBC unaffected, vulnerability due to third-party token contract "infinite minting" issue

Odaily Planet Daily News reports that cross-chain protocol Axelar Network issued a statement regarding recent security incidents related to Secret Network, stating that there is a misunderstanding within the community. Axelar and the Inter-Blockchain Communication Protocol (IBC) were not attacked or compromised, and the affected token smart contracts were not developed, deployed, or maintained by Axelar. Axelar's firewall mechanisms also prevented the impact from spreading further to other chains.

It is understood that the exploited contract is a fork version based on CW20-ICS20, but the developer removed two core security checks, resulting in an "infinite mint" vulnerability. Because the original validation mechanisms designed to prevent such issues were removed, this fork altered the contract's original trust model and was not subjected to a new security audit.

Axelar Network explained that anyone can deploy cross-chain asset wrapping contracts via IBC, and similar contracts are used to wrap tokens from other chains into Secret Network. However, the forked version of Secret involved in this incident had a vulnerability due to the removal of key security checks. This incident is not due to a logical flaw in the protocol itself or IBC, but rather a security risk introduced by modifications made by a third-party contract.