News

On November 23, Port3 Network announced on social media that PORT3 adopted Nexa Network's cross-chain token solution CATERC20 to support multi-chain development. However, this solution has a boundary condition verification vulnerability. When token ownership is renounced, the function's return value happens to match the owner verification condition, causing the permission check to fail and making unauthorized access possible. This vulnerability was not detected in the CATERC20 audit report. Since PORT3 tokens had previously renounced ownership to enhance decentralization, they were precisely in a state where this vulnerability could be exploited. After discovering this authorization verification flaw, a hacker initiated a RegisterChains operation at 20:56:24 UTC from address 0xb13A...812E, registering their own address as an authorized address. The attacker then repeated the same attack method from multiple addresses such as 0x7C2F...551fF. The official team has contacted major exchanges to suspend deposit and withdrawal services. Next, they will completely resolve this issue by reissuing a fixed version of the token.

ChainCatcher reported that Port3 Network released an incident report on platform X regarding a hacker attack. Port3 Network stated that it adopted NEXA Network's cross-chain token solution, CATERC20. However, CATERC20 has a boundary condition verification vulnerability. After the token ownership is renounced, the function returns a value of 0, which happens to meet the ownership verification condition. As a result, the ownership check fails, making unauthorized access possible. This issue was not pointed out in the CATERC20 audit report. Since Port3 tokens had previously renounced ownership to achieve greater decentralization, they are currently in this vulnerable state.