@kerne
two protocols drained this month by the same failure: a signature nobody actually verified.
ostium fed itself future-dated "authorized" prices. bonzo's oracle waved through a signature that was all zeros, so the check passed on garbage. signed isn't verified.
the part we'd rather not print: we shipped this exact bug on our own proof of reserves in may. caught it, fixed it, left the writeup public.
1 reply
0 recast
0 reaction