Oraichain: Unauthorized ORAI Minting via EVM Cross-Chain Transfer Path Flaw

On August 9, 2026, a vulnerability in Oraichain's EVM cross-chain transfer path allowed an attacker to mint unauthorized ORAI tokens. The network was halted at 04:00 UTC; bridges and cross-chain routes remain restricted while the team burns illegitimate balances.

Root Cause

Oraichain's EVM cross-chain transfer path — the module that bridges between its native Cosmos-based chain and EVM-compatible execution — contained a vulnerability that failed to enforce mint authority correctly. The pathway did not sufficiently validate that token-mint requests originating from cross-chain relayers were tied to legitimate burn or lock events on the origin chain.

As a result, an attacker was able to trigger the EVM-side minting function without a corresponding on-chain deposit or lock, creating ORAI tokens out of thin air.

// Illustrative pattern of the class of vulnerability
// A bridge mint function that does not verify the source event on-chain:
function mintFromBridge(address to, uint256 amount, bytes calldata proof) external onlyRelayer {
    // MISSING: verification that `proof` corresponds to a real burn/lock tx
    // on the origin chain. Without this check, a compromised or spoofed
    // relayer can mint arbitrary amounts.
    _mint(to, amount);
}

Attack Steps

Step	Action	Effect
1	Attacker submits a crafted cross-chain transfer message to the EVM path	Message passes relayer validation
2	EVM bridge contract mints ORAI without verifying on-chain lock event	Unauthorized ORAI tokens created
3	Attacker repeats or scales the operation before detection	Supply inflated
4	Oraichain team detects anomaly at 04:00 UTC Aug 9	Network halted; bridges restricted

Impact

Loss: Exact USD figure not publicly disclosed at time of writing; team is coordinating with CEXs to restrict fund movements
Network status: MAINnet halted since 04:00 UTC August 9, 2026; bridges and cross-chain routes restricted
Remediation: Vulnerable pathway identified and addressed; team preparing to burn unauthorized minted balances and reconcile canonical ORAI supply
Chain: Oraichain EVM (cross-chain between Cosmos and EVM)

Lessons for Auditors

Bridge mint authorization: Any EVM-side mint function callable by a relayer MUST verify that a corresponding lock or burn event exists and is finalized on the source chain. Use on-chain proofs (Merkle proofs, light-client verification) rather than relying solely on relayer attestation.
Supply invariant monitoring: Token contracts with cross-chain minting paths should expose or monitor a totalMinted ≤ totalLocked invariant; anomalies should trigger automatic circuit-breakers.
Relayer trust model: Treat relayers as potentially adversarial. Multi-sig relayer sets and threshold signing reduce the blast radius of a single compromised or spoofed relayer.
Upgradeable bridge contracts: Ensure proxy upgrades on bridge contracts require timelocks and multi-sig approvals — an attacker who can upgrade can bypass all mint guards.