The ixo-blockchain suffers from a critical authorization bypass vulnerability that enables unauthorized fund transfers, which has been confirmed as actively exploited in the wild.

The vulnerability exists due to improper authorization within the x/bonds module, which fails to verify that the address resolved from a Decentralized Identifier (DID) matches the transaction signer. This allows an unauthenticated attacker to associate a victim's address with a malicious DID and move the victim's assets into a controlled bond.

The impact of this vulnerability is severe, as it permits direct theft of blockchain assets without requiring victim keys, signatures, or existing system compromise. Given the CVSS score of 9.3, this flaw presents a critical risk to the financial integrity of the platform, potentially leading to total loss of funds for users and significant reputational damage to the ixo-blockchain ecosystem.

Immediate Action: All node operators and validators must immediately upgrade to version 8.0.0, which disables the vulnerable x/bonds module and mandates a network-wide software upgrade.

Proactive Monitoring: Network administrators should review transaction logs for any unusual batch processing activity or irregular movements of funds associated with the x/bonds module handlers.

Compensating Controls: As the flaw resides in the consensus logic, there are no application-level workarounds, and network participants must perform the binary upgrade to secure the chain state machine.

Public Exploit Available: Unknown

This is a critical security event that has already resulted in real-world financial theft. Operators are urged to prioritize the upgrade to v8.0.0 immediately to prevent further unauthorized fund transfers. Failure to apply this patch leaves the network and its users exposed to ongoing exploitation and asset loss.