Harmony ONE: 3 Trillion Tokens Forged via Cross-Shard Receipt Replay and Quorum Bypass

Root Cause

Harmony Protocol contained two compounding vulnerabilities in its cross-shard consensus layer:

Vulnerability 1: Cross-Shard Receipt Replay

Harmony's inter-shard messaging protocol failed to enforce single-use semantics on cross-shard receipts. Once a receipt was validated on the receiving shard, it could be submitted again—and re-executed—without triggering a duplicate-detection error. Each successful replay minted fresh ONE tokens on the destination shard without debiting any balance elsewhere.

Vulnerability 2: Quorum Signature Check Bypass

Harmony's consensus quorum verification counted every public key listed in the BLS signature bitmask as a valid signer, rather than counting only keys whose actual cryptographic signatures passed verification. An attacker could craft a consensus message that listed many public keys in the mask but carried zero valid signatures—yet the quorum threshold check would still pass because it counted mask entries, not verified signers.

// Pseudocode illustrating the broken quorum check:
func isQuorumMet(msg ConsensusMsg, validators []PubKey) bool {
    count := 0
    for _, key := range validators {
        if msg.SigMask.Has(key) {   // ← counts mask entries, not verified sigs
            count++
        }
    }
    return count >= quorumThreshold  // BUG: signatures never actually verified
}

Combined, these two flaws let the attacker: (a) forge a cross-shard receipt carrying zero real signatures that passed the quorum check, and (b) replay it hundreds of times to continuously mint tokens.

Attack Steps

Impact

• Forged supply: ~3.01 trillion ONE tokens (≈20% of pre-attack circulating supply)
• Token price drop: ONE fell 37–40% at peak before partial recovery
• Exchange exposure: 97% of forged tokens reached exchange deposit addresses before the network could freeze them
• Network action: Harmony executed a hard rollback erasing all blocks after the fork point, discarding all post-attack transactions in both Shard 0 and Shard 1
• Decentralization concern: The rollback decision, made by a small set of validators on a short timeline, drew criticism about the practical limits of blockchain immutability under emergency conditions
• Financial loss: Difficult to quantify post-rollback; exchanges that honored withdrawals of forged ONE before the freeze absorbed real losses

Lessons for Auditors

1. Cross-shard/cross-chain receipt uniqueness must be enforced on-chain: Every cross-shard or cross-chain message must carry a globally unique nonce and a consumed-nonce set checked atomically on execution. Relying on off-chain monitoring to detect replays is insufficient.
2. Verify signatures, not masks: BLS aggregate signature verification must iterate over and cryptographically verify each included signer, not merely count bits in a participation mask. Separate the parsing of "who claimed to sign" from "whose signature verified."
3. Supply reporting endpoints must be derived from the live state: Any view function that reports totalSupply must read from the same authoritative state root as transfer logic—cached or indexed values can lag and mask exploits.
4. Fuzz cross-shard message flows: Consensus-layer bugs that require specific timing (106-second window, 534 rapid transactions) are hard to catch with unit tests. Property-based fuzzing over message sequencing and state transitions is essential.
5. Immutability vs. emergency response: Chains with validator rollback capabilities should have pre-defined, on-chain governance processes for invoking them—ad-hoc rollbacks erode trust even when technically necessary.