Critical Authorization Bypass in ixo-blockchain x/bonds Module

The ixo-blockchain project identified a critical authorization vulnerability (CVE-2026-61604) affecting the x/bonds module across multiple versions. The flaw resides in the handling of DID (Decentralized Identifier) verification methods. The system incorrectly resolved addresses from these methods without verifying that the resolved address belonged to the transaction signer.

Because any account can register an arbitrary blockchainAccountID as a verification method on a DID they control, attackers were able to associate victim addresses with their own DIDs. By executing bond-related transactions such as MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, or MsgWithdrawShare, the attacker forced the chain to drain funds from the victim's account into a bond controlled by the attacker. This vulnerability was exploited on the ixo-5 mainnet on 2026-06-20. The issue is deeply embedded in the chain's state-machine logic, necessitating a consensus-level upgrade to v8.0.0, which disables the x/bonds module entirely to stop unauthorized fund movements.

Attack Chain

1. Attacker creates or controls a Decentralized Identifier (DID) on the ixo network.
2. Attacker registers an arbitrary victim's blockchain address as a verification method within the DID document.
3. The system fails to validate authorization, incorrectly mapping the victim's account to the attacker-controlled DID.
4. Attacker submits a bond-related transaction (e.g., MsgBuy or MsgSwap) specifying the compromised DID.
5. The x/bonds module, failing to verify signer ownership, pulls assets from the victim's address based on the tainted DID resolution.
6. The transaction completes, transferring the victim's tokens into an attacker-controlled bond.
7. Attacker proceeds to withdraw and bridge the accumulated proceeds off-chain.

Impact

The vulnerability led to the unauthorized drainage of funds from arbitrary user accounts on the ixo-5 mainnet. Because the attack required no victim keys or system access, any account holding a balance in a token compatible with the x/bonds module was at risk. The total financial impact highlights the severity of consensus-level authorization flaws in blockchain state machines.

Recommendation

1. Upgrade all ixo-blockchain node and validator software to version 8.0.0 immediately.
2. Note that v8.0.0 disables the x/bonds module; operators should plan for the functional loss of this module until a future, secured version is released.
3. Audit recent on-chain activity related to DID document updates and subsequent x/bonds transactions (MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, MsgWithdrawShare) to identify potential account drainage events during the window of exploitation.