CriticalFix available

ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

Type: advisorySource: OSV1 source record

Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and MsgWithdrawShare, as well as the batch order processor. Because any account may list an arbitrary blockchainAccountID as a verification method on a DID it controls (without the consent of that address's owner), an attacker could register victims' addresses as verification methods on their own DID and then move the victims' balances into a bond the attacker controlled — later withdrawing and bridging the proceeds off-chain. This was exploited on ixo mainnet (ixo-5) on 2026-06-20. The attack required no victim keys, signatures, or system compromise — any account holding a balance in a token a bond could use was at risk. Patches Fixed in v8.0.0, delivered via the on-chain v8 software-upgrade. The x/bonds module is disabled: every bonds message is rejected on all routes (top-level, authz, CosmWasm, and ICA), and the bonds batch EndBlocker is a no-op so no further reserve movements can occur. All node operators and validators must upgrade to v8.0.0. The flaw is in chain state-machine logic and can only be remediated by running the patched binary. Workarounds There is no application-level workaround. The vulnerability is in consensus logic; remedi

Announced 24 Sept 2026Group revision 1

Original source ↗

GHSA-w3rp-4cm2-4wgc

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-w3rp-4cm2-4wgc

github.com/ixofoundation/ixo-blockchain/v8

Source reference: /affected/0/package/name

Affected versions: Not stated in this record
Fixed versions: 8.0.0
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

github.com/ixofoundation/ixo-blockchain/v7

Source reference: /affected/1/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

github.com/ixofoundation/ixo-blockchain/v6

Source reference: /affected/2/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

github.com/ixofoundation/ixo-blockchain/v5

Source reference: /affected/3/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

github.com/ixofoundation/ixo-blockchain/v4

Source reference: /affected/4/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

github.com/ixofoundation/ixo-blockchain/v3

Source reference: /affected/5/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

github.com/ixofoundation/ixo-blockchain

Source reference: /affected/6/package/name

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "8.0.0"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/ixofoundation/ixo-blockchain/v8",
      "purl": "pkg:golang/github.com/ixofoundation/ixo-blockchain/v8",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-w3rp-4cm2-4wgc/GHSA-w3rp-4cm2-4wgc.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "last_affected": "7.0.0"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/ixofoundation/ixo-blockchain/v7",
      "purl": "pkg:golang/github.com/ixofoundation/ixo-blockchain/v7",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-w3rp-4cm2-4wgc/GHSA-w3rp-4cm2-4wgc.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "last_affected": "6.0.1"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/ixofoundation/ixo-blockchain/v6",
      "purl": "pkg:golang/github.com/ixofoundation/ixo-blockchain/v6",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-w3rp-4cm2-4wgc/GHSA-w3rp-4cm2-4wgc.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "last_affected": "5.0.0"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/ixofoundation/ixo-blockchain/v5",
      "purl": "pkg:golang/github.com/ixofoundation/ixo-blockchain/v5",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-w3rp-4cm2-4wgc/GHSA-w3rp-4cm2-4wgc.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "last_affected": "4.0.0"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/ixofoundation/ixo-blockchain/v4",
      "purl": "pkg:golang/github.com/ixofoundation/ixo-blockchain/v4",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-w3rp-4cm2-4wgc/GHSA-w3rp-4cm2-4wgc.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "last_affected": "3.0.0"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/ixofoundation/ixo-blockchain/v3",
      "purl": "pkg:golang/github.com/ixofoundation/ixo-blockchain/v3",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-w3rp-4cm2-4wgc/GHSA-w3rp-4cm2-4wgc.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "last_affected": "1.6.0"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/ixofoundation/ixo-blockchain",
      "purl": "pkg:golang/github.com/ixofoundation/ixo-blockchain",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-w3rp-4cm2-4wgc/GHSA-w3rp-4cm2-4wgc.json"
    }
  }
]

Related CVEs: CVE-2026-61604
Source reference: /aliases

Publisher severity

critical

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-61604 · Critical

ixo-blockchain

Event: #63882 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 19:52:12 GMT
Publisher date: Thu, 24 Sep 2026 19:22:53 GMT

Read the original announcement

Revision history

25 Oct 2026GHSA-w3rp-4cm2-4wgc · Revision 1Source updated