🛡 ChainConnect Post-Mortem: Alien Proxy Callback Exploit 🛡

On July 26th, an unauthorized caller exploited an access-control flaw in a ChainConnect bridge contract on Venom 2.0.

The vulnerability was in their application-level code (specifically the ProxyMultiVaultAlien_V10.onCheckAccumulatedFee callback), which lacked proper sender verification. This allowed the minting of unbacked Alien TIP-3 tokens that were then bridged to Ethereum through the standard flow.

The issue was not related to Venom, the TVM, the TIP-3 standard, network infrastructure, relays, or any core components. No keys or privileged access were compromised.

Actions taken and fund recovery

ChainConnect has taken full responsibility, patched the vulnerability across all affected deployments, and conducted a thorough review of their callback and minting logic.

👉 82.9% of the affected funds (~615k USD) were returned, with 17.1% retained as a bounty.

Venom and ChainConnect
Venom is an independent public blockchain. ChainConnect is a separate project building on the broader ecosystem. Our team assisted them during the investigation, but we were not involved in the root cause.

🔗 Full technical post-mortem from ChainConnect: https://t.me/chainconnect_news/9