🚨 We analyzed a CRITICAL vulnerability in $PORT3
A perfect storm of 3 bugs allowed attackers to:
✓ Bypass authorization with EMPTY signatures
✓ Register fake chains
✓ Mint UNLIMITED tokens
✓ Drain bridge liquidity
The root cause? Owner = 0x0
What happened 🧵
With fake chain registered:
tokenContracts[23] = 0x4644bbcfd26... // Attacker's contract
Now attacker can:
Forge Wormhole message from "chain 23"
Set emitter = their contract
Set amount = UNLIMITED
Call bridgeIn()
Contract mints tokens ✓
FUNDS DRAINED
52
The Attack Transaction
Here's the actual exploit transaction: bscscan.com/tx/0xe3391f44469…
Attacker calls with:
Valid custodian (themselves)
Valid timestamp
INVALID signature (all zeros)
Transaction succeeds 🔥
38
Critical bug: Signature verification doesn't check for zero address
Here's the trap:
Invalid signatures return 0x0 from ecrecover
If authority = 0x0
Then: 0x0 == 0x0 → TRUE ✗
Authorization BYPASSED with invalid signature
63
When a non-owner wants to call sensitive functions, they must provide:
✓ Valid custodian address
✓ Non-expired timestamp
✓ VALID SIGNATURE
25
CATERC20 is a cross-chain token bridge using:
Wormhole for cross-chain messaging
Signature verification for governance
registerChains() to whitelist token bridges
Problem: The authorization mechanism had a critical flaw.
1
73
Phạm Tiến Minh Đức retweeted
let’s do a quickie😈
💎 Lifetime Access to @Bheem_Lounge (worth $2,500)
Will pick anyone from likes/retweets or comment section randomly
Ends in 60 minutes, goodluck😼
Phạm Tiến Minh Đức retweeted
bheem is happy so $1,000 USDT giveaway😗
To top it off, Lifetime Access to @Bheem_Lounge vip (worth $2,000)
discord.gg/wAdxTBYbBS
Just like this tweet & join above, winner in 24h- glhf🤝
Phạm Tiến Minh Đức retweeted
$BTC update:
>Must remain above 63.3k
>Key level 66.1k
Change in MS depending on reaction at 66.1k📌 rejection and PA similar to left shoulder or immediate reclaim depending on news day.
Right shoulder valid once 1D close below 63.3k otherwise opt for upside (my long open)
$BTC update:
66,128 is the pivot now.
As long as above it, 70k next.
Upon loss on H4, retest of 64.3k.
Phạm Tiến Minh Đức retweeted
Do you want to make consistent profits each month?
Participate to win a lifetime subscription to @Bheem_Lounge worth $1500.
Still not enough? Win an additional $1000 in USDT by becoming a ByBit user: forms.gle/Ur4Jd6GcEBoZTvDj6
❤️ & ♻️ to enter !!
Phạm Tiến Minh Đức retweeted
Our previous tweet got botted therefore we’re redrawing the giveaway.
1. Follow @Bheem_Lounge
2. Like & Retweet this post
3. Join our discord (link in bio)
Subscription worth $1200, drawn in 24 hours📣
