A bug in Nomic's custom IBC forwarding path let an attacker mint 39.84 unbacked nBTC on June 25, tearing a 36% hole in the backing of Osmosis's Alloyed BTC basket. The shortfall sat unnoticed for 74 days until Osmosis disclosed it this week and locked 22.65 BTC tied to the exploit. Osmosis is now asking governance to seize those funds and tap its community pool to restore the basket's full backing.
Nomic bug tears a hole in Alloyed BTC's backing
A software flaw in Nomic's custom IBC forwarding path let an attacker mint unbacked nBTC and stash most of it inside Osmosis's Alloyed BTC basket. What sounds almost unbelievable, yet is demonstrably true, is that the mint occurred on June 25 and stayed hidden for 74 days.
Osmosis said the exploit sat in Nomic's forwarding mechanism, not in Osmosis or the underlying IBC protocol itself. According to Osmosis: "39.84 nBTC of the minted total sits within Alloyed BTC, representing ~36% of its backing".
Osmosis freezes funds and turns to governance
Once the team found the problem, Osmosis said it quickly shut down deposits and withdrawals tied to Nomic and Alloyed BTC to stop further losses. Validators then pushed an emergency update that locked 22.65 BTC still sitting in the attacker's wallet.
Osmosis now wants governance to seize those funds and use accrued BTC in the community pool to cover the remaining balance and make Alloyed BTC fully backed again.
Researcher traces the flaw to a doubled deposit
Independent researcher Rarma, who reviewed the code, found that Nomic's system accidentally created the same bitcoin deposit twice, with the second copy spendable as extra nBTC. Rarma said this was the only one of 18 similar processes in the file that duplicated coins this way, and that the system never verified who controlled the receiving account.
The attack cost just one satoshi to execute. Rarma noted the flawed code was still unchanged in Nomic's development branch when he published his findings on Sept. 8 — Osmosis posted its security update the very next day.
Source: Bitcoin News
Trading involves risk.
Risk Disclaimer
