ChainConnect Post-Mortem: Alien Proxy Exploit
Summary
Venom Foundation (The New Venom Mainnet Is Live) announces a ChainConnect post-mortem for a July 26 exploit in ProxyMultiVaultAlien_V10.onCheckAccumulatedFee that enabled minting of unbacked Alien TIP-3 tokens bridged to Ethereum. The issue was application-level and not related to Venom core. ChainConnect patched deployments and recovered 82.9% (~615k USD) with 17.1% retained as bounty.
🛡 ChainConnect Post-Mortem: Alien Proxy Callback Exploit 🛡
On July 26th, an unauthorized caller exploited an access-control flaw in a ChainConnect bridge contract on Venom 2.0.
The vulnerability was in their application-level code (specifically the ProxyMultiVaultAlien_V10.onCheckAccumulatedFee callback), which lacked proper sender verification. This allowed the minting of unbacked Alien TIP-3 tokens that were then bridged to Ethereum through the standard flow.
The issue was not related to Venom, the TVM, the TIP-3 standard, network infrastructure, relays, or any core components. No keys or privileged access were compromised.
Actions taken and fund recovery
ChainConnect has taken full responsibility, patched the vulnerability across all affected deployments, and conducted a thorough review of their callback and minting logic.
👉 82.9% of the affected funds (~615k USD) were returned, with 17.1% retained as a bounty.
Venom and ChainConnect
Venom is an independent public blockchain. ChainConnect is a separate project building on the broader ecosystem. Our team assisted them during the investigation, but we were not involved in the root cause.
🔗 Full technical post-mortem from ChainConnect: https://t.me/chainconnect_news/9
Discord sent us an expired image link.
