Circle fixes critical vulnerability in Noble-CCTP, no user funds lost or malicious attacks occurred

On August 27, blockchain security company Asymmetric Research disclosed that it had discovered a critical vulnerability in Circle's Noble-CCTP (a component of the USDC USDC cross-chain transfer protocol) on the Cosmos network and had privately notified Circle. The vulnerability has been fixed in a timely manner, and no user funds have been lost or malicious attacks have occurred. The security company found that malicious actors could circumvent the message sender verification process of the cross-chain transfer protocol and forge USDC on the Noble bridge. More specifically, the Noble-CCTP "ReceiveMessage" handler accepts "BurnMessages" from any sender without first checking whether the bridge message is sent from a verified "TokenMessenger" address on the initial chain. However, although the vulnerability initially looks like an infinite casting defect, the actual impact is limited due to Noble's casting limit of approximately 35 million USDC. (Cointelegraph)