No Impact on Axelar or IBC; Vulnerability Traced to Third-Party Token Contract

ChainCatcher report: In response to the recent security incident involving Secret Network, the cross-chain protocol Axelar Network issued a statement clarifying that there has been a misunderstanding within the community. Neither Axelar nor the Inter-Blockchain Communication Protocol (IBC) was attacked or compromised. The affected token smart contract was not developed, deployed, or maintained by Axelar, and Axelar’s firewall mechanisms prevented the impact from spreading further to other chains. The exploited contract is a forked version based on CW20-ICS20, but the developer removed two critical security checks, resulting in an “infinite minting” vulnerability. By eliminating the original safeguards designed to prevent such issues, this fork altered the contract’s underlying trust model and was never subjected to a new security audit. Axelar Network explained that anyone can deploy smart contracts via IBC for cross-chain asset wrapping, and similar contracts are commonly used to wrap tokens from other chains onto Secret Network. However, the Secret-side fork in this incident contained vulnerabilities due to the removal of essential security checks. This incident is not caused by a unique logic flaw or a problem with the IBC protocol itself, but rather by security risks introduced through third-party modifications to the contract.