ChainConnect Bridge Callback Exploit — White Hat Resolution

T0 — July 26, 2026, ~01:50 UTC: An unauthorized caller exploits a missing callback-sender authentication check in ChainConnect's ProxyMultiVaultAlien_V10.onCheckAccumulatedFee(TvmCell) function, deployed on Venom 2.0. The function failed to verify that the call originated from the expected BridgeTokenFee contract, and accepted caller-controlled values for the token root, recipient, and fee amount. The caller invokes the callback directly with a forged payload, minting unbacked Alien TIP-3 tokens, then burns them through ChainConnect's standard bridge interface specifying an Ethereum recipient — producing a valid outgoing event that relays approved normally, causing the EVM vault to release genuine assets against the unbacked tokens. Gross affected amount: ~$615K. Venom's consensus, core protocol, infrastructure, and user accounts were not compromised — the flaw was isolated to ChainConnect's application-level contract code. July 28, 2026, 09:57:35 UTC: ChainConnect's authorized signatory (0x68D447E2a4C6E7C1945725939A0CBcb4A67F9B30) sends an on-chain proposal to the attacker offering a standard 85%/15% white-hat deal: return 85% to 0x840B3De19e3FAB72fa9A168bD8Dd71B678c57989, retain 15% as a bounty, with ChainConnect committing to public whitehat acknowledgment and no civil pursuit. July 29, 2026: A separate, unauthorized on-chain message attempts to redirect the fund return to a different address (0x9c961a0d...37aF28B1eA), impersonating ChainConnect — this spoofing attempt does not succeed. July 30, 2026, 04:41:35 UTC: The attacker accepts the legitimate proposal as a whitehat. July 30, 2026, 18:30:59 UTC: 280 ETH is returned to 0x840B3De19e3FAB72fa9A168bD8Dd71B678c57989 (tx 0xe78bfae09b6b8fab1057f472f605044dea8d066b73e5012837050a5bc6d6eb00). July 31, 2026: ChainConnect publicly confirms receipt and considers its commitments under the agreement fulfilled, closing the matter as resolved. ChainConnect subsequently patches the vulnerability across all affected bridge-generation deployments (Humo, Msharia, TON, Tetra, Venom 2.0) by requiring onCheckAccumulatedFee callbacks to originate strictly from the expected BridgeTokenFee contract, and commits to a broader review of callback handlers and an additional security audit.