Researchers discovered a critical bug in the Provenance Blockchain, a public proof-of-stake chain, that allowed unauthorized users to gain admin control over marker accounts. This vulnerability affected 82 markers representing live financial assets on the mainnet. The bug, present in versions before 1.28.0, was reported to Provenance on April 1, 2026. It was mitigated in version 1.28.0 and fully fixed in version 1.29.0.Markers are Provenance's core primitive for fungible tokens, each controlling a denomination, an access control list, a supply field, and an escrow balance. The vulnerability resided in the authorization check for modifying a marker's access control list. Specifically, a condition intended to grant access to users holding 100% of a marker's supply was flawed. For non-fixed supply markers activated with zero supply, the stored supply field remained zero, causing the access check to evaluate as trivially true for any caller.This allowed an attacker to grant themselves admin, mint, and withdraw permissions with a single transaction, without holding any tokens. Subsequently, they could mint new tokens or drain assets from the marker's escrow balance. The impact was significant, with escrowed funds in some markers totaling around $500,000.The initial mitigation added a check to prevent the authorization from passing if the stored supply was zero. However, the complete fix involved changing the code to read the live circulating supply directly from the bank module, eliminating state desynchronization. The root cause was identified as state desynchronization between the marker struct and the bank module, combined with an authorization predicate vulnerable to zero supply states. The article suggests improved specification and property-based testing as future preventative measures.