Unauthenticated execution traces are applied to real state, forging balances
- Severity
- Critical
- Class
- Value integrity
- System
- Privacy Layer-1 (non-hardware-attested path)
Replayed execution traces are trusted and written to the real store, letting an attacker forge cross-module state and mint native funds.
A path meant to reflect the results of trusted execution accepted execution traces without authenticating where they came from, then applied them to the real multi-module store. An attacker able to supply traces could therefore write state the system never actually produced.
Once you can write arbitrary state to the real store, the usual guarantees — balances, ownership, supply — stop meaning anything.
Why it rated Critical
Cross-module state forgery and native minting on a deployment that removes the hardware attestation the design leans on for trust.
The fix class
Authenticate the origin of any trace before applying it, so unattested execution can never reach real state.
