⚠️ [SECURITY] Unauthorized Minting & ICA Account Takeover via Bank/ICA Precompiles

## Summary

A critical vulnerability exists in the EVM precompile modules for `x/bank` and `x/ica` on the Cronos chain. This flaw potentially allows:
- **Unauthorized Token Minting:** Bypassing module-level authorization checks.
- **Interchain Account (ICA) Takeover:** Compromising ICA accounts via crafted cross-chain packets.
- **Result:** Direct fund theft and potential token inflation.

The core issue stems from insufficient ownership validation within the EVM precompile entry points when invoked indirectly via IBC packet handlers. Specifically, there appears to be a lack of checks ensuring `msg.sender` corresponds to the authorized owner or delegate for sensitive operations.

## Details

- **Component:** EVM Precompiles (`bank`, `ica`)
- **Location:** Likely in `/precompiles/bank/` and `/precompiles/ica/` directories or equivalent.
- **Mechanism:**
1. An attacker crafts a specific IBC packet destined for the Cronos chain.
2. This packet triggers an IBC packet handler (e.g., in `x/ica`).
3. The handler subsequently calls into the EVM precompile (e.g., `BankPrecompile.Transfer` or `ICAPrecompile.Call`).
4. Due to missing validation (e.g., `msg.sender == owner` or `authz` checks), the precompile executes sensitive operations (like token transfers or arbitrary calls on behalf of the ICA owner) without proper authorization.
- **Impact:**
- An attacker could mint arbitrary tokens if the `bank` precompile is involved in minting functions.
- An attacker could execute unauthorized transactions from an ICA account, potentially draining its funds or altering its state.

## Previous Disclosure

This issue was previously reported to Crypto.com via HackerOne (Report #3595710, submitted Mar 10, 2026) under the username `rdin777`. Crypto.com confirmed the issue is out of scope for their program and recommended contacting the Cronos team directly. Multiple attempts to contact the Cronos security team via `security@cronos.org` have received no response as of yet.

## References

- HackerOne Report: #3595710 (Status: Informative - Out of Scope for Crypto.com)
- Related Research: [DeFi Security Blueprint - Case Studies](https://github.com/rdin777/defi-security-blueprint/blob/main/case_studies_new.md) (See "Cronos ICA Precompile Issue (March 2026, Out of Scope)" section added for transparency regarding the disclosure attempt).

## Recommendation

Please investigate this issue urgently. If confirmed, immediate patching and coordination for a network upgrade will be necessary to mitigate the risk. I am available to provide further technical details or a Proof of Concept if directed to a secure communication channel by the Cronos team.

## Labels

`security`, `critical`, `precompile`, `ica`, `bank`, `ibc`

Start by tracing the IBC packet handler in x/ica into the entry points in /precompiles/bank/ and /precompiles/ica/, especially BankPrecompile.Transfer and ICAPrecompile.Call. Compare the authorization behavior for direct and indirect calls. Done means the reported minting and ICA takeover paths are confirmed or disproved and any required mitigation is identified for review.

Written by the indexing model from the issue text.