Issues

[Security] covenantV1 withdrawalTimeLockTransaction missing psbt.setVersion(2), bypassing CSV timelock and enabling immediate fund theft

#472

· HusseinAdeiza opened

on Sep 17, 2026

[Security] PegOutGraph n_of_n_presigned set true after single verifier signs all txs, defeating n-of-n committee authorization

#471

· HusseinAdeiza opened

on Sep 17, 2026

[Security] L2 Gateway requires GUARDIAN_CONNECTOR_VOUT=4 but GC-V2 L1 graphs spend the kickoff guardian connector at vout 3 - every QuickChallenge/ChallengeIncompleteKickoff disprove reverts TxidMismatch

#470

· HusseinAdeiza opened

on Sep 16, 2026

[Security] fetch_history_events tight-loops without sleep when from_height exceeds indexer finalized height (CPU spin until restart)

#468

· byfor8 opened

on Sep 15, 2026

[Security] detect_init_withdraw_call latches InitWithdraw to Processed with no KickoffReady when find_graph fails (withdrawal stuck, no retry)

#467

· byfor8 opened

on Sep 15, 2026

[Security] History catchup spawns concurrent fetch_history_events tasks before Syncing is set, racing the Gateway event cursor (state desync)

#466

· byfor8 opened

on Sep 14, 2026

[Security] Sticky Processed on InitWithdraw goat_tx_record permanently blocks re-initiated withdrawals after user cancel (fund lock-up)

#465

· byfor8 opened

on Sep 14, 2026

[Security] instance_answers_monitor overwrites a live peg-in instance with a blank UserDiscarded stub via unguarded upsert_instance (DoS / state corruption)

#464

· byfor8 opened

on Sep 14, 2026

KickoffReady permanently dropped when previous-graph row is missing from local DB — withdrawal stuck forever with no re-trigger path

#462

· dupint opened

on Sep 11, 2026

Bounty Migrated

#457

· SuperSmile0426 opened

on Sep 5, 2026

Predictable bridge-out instance IDs let any caller permanently wedge the committee watcher's bridge-out cursor

#448

· mr-hrydarie opened

on Aug 24, 2026

Auth signature does not bind method, path, or body — LOW/MEDIUM

#447

· DQiash opened

on Aug 24, 2026

Navigation Menu

All issues

[Security] covenantV1 withdrawalTimeLockTransaction missing psbt.setVersion(2), bypassing CSV timelock and enabling immediate fund theft

[Security] PegOutGraph n_of_n_presigned set true after single verifier signs all txs, defeating n-of-n committee authorization

[Security] L2 Gateway requires GUARDIAN_CONNECTOR_VOUT=4 but GC-V2 L1 graphs spend the kickoff guardian connector at vout 3 - every QuickChallenge/ChallengeIncompleteKickoff disprove reverts TxidMismatch

[Security] fetch_history_events tight-loops without sleep when from_height exceeds indexer finalized height (CPU spin until restart)

[Security] detect_init_withdraw_call latches InitWithdraw to Processed with no KickoffReady when find_graph fails (withdrawal stuck, no retry)

[Security] History catchup spawns concurrent fetch_history_events tasks before Syncing is set, racing the Gateway event cursor (state desync)

[Security] Sticky Processed on InitWithdraw goat_tx_record permanently blocks re-initiated withdrawals after user cancel (fund lock-up)

[Security] instance_answers_monitor overwrites a live peg-in instance with a blank UserDiscarded stub via unguarded upsert_instance (DoS / state corruption)

KickoffReady permanently dropped when previous-graph row is missing from local DB — withdrawal stuck forever with no re-trigger path

Bounty Migrated

Predictable bridge-out instance IDs let any caller permanently wedge the committee watcher's bridge-out cursor

Auth signature does not bind method, path, or body — LOW/MEDIUM

Search results