Critical vulnerability found in 6-character cross-chain tokens