CAT Protocol Unauthorized Token Creation Exploit
Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!
CAT Protocol is an innovative token protocol built on Bitcoin using a UTXO-based system and smart contracts, specifically covenants, to manage token minting and transfers. It operates directly on the Bitcoin blockchain, ensuring token rules and data are enforced by Bitcoin's consensus, without relying on off-chain indexers. The protocol faced a vulnerability in December 2024 which allowed for the unauthorized creation of 1.2 million $OPCAT tokens, which were sold and caused a decline in the token price. The CAT Protocol team, in collaboration with @SlowMist_Team, quickly mitigated the exploit by halting trading, deploying a hotfix and burning the inflated tokens to restore the supply to 21 million. No user funds were lost, and the protocol is implementing enhanced security measures to prevent similar incidents. The exploit was later recognized as a white-hat action when the responsible party returned the assets in good faith.[1][2][3][4][5][6]
About CAT Protocol
CAT Protocol is a novel token protocol on Bitcoin that uses a UTXO-based system and smart contracts, specifically covenants, to manage token minting and transfers. It operates directly on the Bitcoin blockchain, ensuring that token rules and data are guaranteed by Bitcoin's consensus, without relying on off-chain indexers. The protocol is modular and programmable, allowing for customizable minting rules and supporting both fungible (CAT20) and non-fungible (CAT721) tokens. CAT Protocol also enables cross-chain interoperability and is compatible with Simplified Payment Verification (SPV), allowing light clients like mobile phones to verify token transactions independently. It aims to expand Bitcoin’s use cases by enabling decentralized applications, such as automated market makers, lending, and staking.
The Reality
The CAT Protocol had a weakness that allowed for unauthorized token creation.
What Happened
The CAT Protocol experienced a vulnerability where an exploit allowed an individual or group to create 1.2 million $OPCAT tokens out of thin air and sell them, causing the token’s price to decline.
| Date | Event | Description |
|---|---|---|
| December 15th, 2024 | First Vulnerability Exploit | The CAT protocol begins being exploited by the attackers, who starts minting 50k CAT tokens per day. |
| January 12th, 2025 | Vulnerability Discovered | CAT Protocol reportedly discovers the vulnerability, which has been continuously exploited every day for 50,000 CAT tokens. |
| January 15th, 2025 6:00:00 AM MST | CAT Protocol Announcement | CAT Protocol announced that they had detected and mitigated an exploit where a suspicious address sold 1.2 million $OPCAT tokens, causing a drop in the token's price. The team, with the help of security partner @SlowMist_Team, took immediate action by notifying exchanges, pausing trading, and releasing a hotfix to prevent further inflation. To compensate affected users, they purchased and burned the inflated tokens, ensuring the total supply remained at 21 million. The community generally reacted positively to the swift and transparent response, with reassurance that no user funds were lost and no further action was needed. |
| January 18th, 2025 6:00:00 AM MST | CAT Protocol Fund Return | CAT Protocol announced that the recent security incident had been resolved, stating that the individual(s) responsible acted with ethical intent and returned the affected assets. The incident was recognized as a white hat action, and the team thanked the involved parties and their security partner @SlowMist_Team for their assistance. They confirmed that no user funds were lost and highlighted that enhanced security measures were being implemented. While many users appreciated the resolution, some were skeptical, questioning the lack of transparency about the asset return and the burn process, with one user expressing concern about the total supply potentially being less than 21 million. Others showed frustration about their losses and the need for more communication, suggesting the team hold a public discussion to address lingering doubts. |
Technical Details
The CAT Protocol experienced a vulnerability where an exploit allowed an individual or group to create 1.2 million $OPCAT tokens out of thin air and sell them, causing the token’s price to decline. The exploit was related to a weakness in the protocol that allowed for unauthorized token creation. This vulnerability was identified when a suspicious address was observed selling large amounts of the token. The CAT Protocol team, along with their security partner @SlowMist_Team, acted quickly to contain the issue by halting trading, deploying a hotfix, and preventing further inflation of the token. They also took steps to burn the inflated tokens and maintain the total supply at 21 million.
Total Amount Lost
All losses were related to the decline in market price of the token.
The total amount lost is unknown.
Immediate Reactions
"On Jan 12, some community members reported a suspicious address (bc1pdx55mhrtu7duv97s9q68rsqf2hk6jv0qhmdtttfrunral0dqp9ps6q80k8) selling ~50K $OPCAT tokens almost daily since Dec 15. Our team immediately investigated and identified a vulnerability that had been exploited."
"With help from our security partner @SlowMist_Team, the issue was quickly contained, and we took decisive steps to prevent any further attempts."
"We immediately notified exchanges and paused trading of the $OPCAT token. We promptly released a hotfix the next day and deployed it to all exchanges to prevent further token inflation."
"We are implementing enhanced measures to prevent similar attacks in the future and engaging with leading security auditors to perform an in-depth review of the protocol."
"We are pleased to confirm that no user funds were lost, and the situation is actively being resolved."
Ultimate Outcome
"To compensate users who have accidentally bought these inflated tokens, we have purchased 1.2M tokens, which will be burned to ensure the total circulating supply remains exactly 21M. Users’ balances will not be affected and no further action is required. In line with our commitment to transparency, we are publishing the holding addresses"
"We are collaborating with leading security firms such as @SlowMist_Team and law enforcement agencies to trace and hold those responsible accountable. If your intent was to expose a vulnerability, we encourage you to engage responsibly and ethically. Reach out through our official email at opcatprotocol@gmail.com, and we’re willing to reward such disclosures within our policies.
Let’s work together to strengthen the ecosystem rather than harm it."
"Update: Incident Resolved
We’re pleased to announce that the recent security incident has been resolved amicably. The individual(s) acted in good faith, demonstrating ethical intent and returning the affected assets.
We officially recognize this as a white hat action and thank them for their cooperation.
No user funds were lost. Enhanced measures are now being put in place.
Thank you for your trust and support as we continue to prioritize security and transparency. Special thanks goes to @SlowMist_Team for their assistance."
Total Amount Recovered
There do not appear to have been any funds recovered in this case.
What funds were recovered? What funds were reimbursed for those affected users?
Ongoing Developments
The CAT Protocol continues to operate.
Individual Prevention Policies
No specific policies for individual prevention have yet been identified in this case.
For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.
Platform Prevention Policies
Policies for platforms to take to prevent this situation have not yet been selected in this case.
For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.
Regulatory Prevention Policies
No specific regulatory policies have yet been identified in this case.
For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.
References
- ↑ CAT Protcol - "Recently, we detected and mitigated an attempted exploit targeting CAT protocol. We are pleased to confirm that no user funds were lost, and the situation is actively being resolved." - Twitter/X (Accessed Mar 6, 2025)
- ↑ CAT Protocol - "On Jan 12, some community members reported a suspicious address (bc1pdx55mhrtu7duv97s9q68rsqf2hk6jv0qhmdtttfrunral0dqp9ps6q80k8) selling ~50K $OPCAT tokens almost daily since Dec 15. Our team immediately investigated and identified...ter/X (Accessed Mar 7, 2025)
- ↑ CAT Protocol - "We are collaborating with leading security firms such as @SlowMist_Team and law enforcement agencies to trace and hold those responsible accountable. If your intent was to expose a vulnerability, we encourage you to engage responsi...ter/X (Accessed Mar 7, 2025)
- ↑ CAT Protocol - "We’re pleased to announce that the recent security incident has been resolved amicably. The individual(s) acted in good faith, demonstrating ethical intent and returning the affected assets. We officially recognize this as a whit...ter/X (Accessed Mar 7, 2025)
- ↑ CAT Protocol - "To compensate users who have accidentally bought these inflated tokens, we have purchased 1.2M tokens, which will be burned to ensure the total circulating supply remains exactly 21M. Users’ balances will not be affected and no f...ter/X (Accessed Mar 7, 2025)
- ↑ Address: bc1pdx55mhrtu7duv97s9q68rsqf2hk6jv0qhmdtttfrunral0dqp9ps6q80k8 (Accessed Mar 7, 2025)