Hexens reveals that Aptos has been fixed for vulnerability that could affect infrastructure such as cross-chain bridges and stablecoins

On July 5, blockchain security company Hexens disclosed that it discovered a serious vulnerability in the Aptos blockchain Move virtual machine (MoveVM) in February this year and completed the repair within hours of the report without causing financial losses. Hexens said that the vulnerability stems from a cache processing flaw that can lead to a type confusion vulnerability that can theoretically be used by attackers to gain high-privilege roles such as stablecoin casting, cross-chain bridges, and DeFi protocols. The research team used a server of about US$3000 to build a simulated environment close to the main network, tested the vulnerability exploitation path about 20 times, and was successful about 17 to 18 times, and evaluated that the vulnerability may affect approximately US$250 million in Aptos native TVL; If it further affects infrastructure such as cross-chain bridges, stablecoins and centralized exchanges, the theoretical systemic risk exposure can reach up to approximately US$70 billion. Aptos said that the vulnerability was extremely exploitable in the real environment and said it had completed the repair in a timely manner through the vulnerability bounty program and did not affect any users or funds.