raph @raphjaph

This is the equivalent of a bouncer checking your ID for holograms, special UV ink and correct microprints but then failing to check that the picture on the ID is actually you...

2 0 24 2K 0

0 0 1 50 0

View Details

raph @raphjaph

2 months ago

@realizingerin More like saved by AI. My stupid human mind couldn't see the tautological comparison across the call chain.

2 0 7 212 1

View Details

raph @raphjaph

2 months ago

This is the equivalent of a bouncer checking your ID for holograms, special UV ink and correct microprints but then failing to check that the picture on the ID is actually you...

Critical vulnerability in the bip322 Rust crate: BIP-322 proofs for P2WPKH and P2SH-P2WPKH addresses could be forged with any attacker key. Full address-ownership bypass. Fixed in 0.0.11, affected versions yanked. If you verify Bitcoin address ownership, please upgrade now.

3 70 260 123K 81

2 0 24 2K 0

View Details

raph @raphjaph

2 months ago

Full advisory: Full advisory: github.com/rust-bitcoin/b…

0 0 13 1K 1

View Details

raph @raphjaph

2 months ago

Timeline (continued): - 08/02/26 @ 13:35: Maintainer acknowledges disclosure receipt - 08/02/26 @ 14:51: 0.0.11 released, 0.0.6-0.0.10 yanked from crates.io - 08/02/26: Private outreach to anyone using bip322 crate - 08/14/26: Public disclosure

1 0 10 1K 0

View Details

raph @raphjaph

2 months ago

3 70 260 123K 81

View Details

Casey @rodarmor

3 months ago

Not to add further chaos to the timeline, but the degenerate runes gambling feature that I added in 0.28.0 can cause users to lose runes, so I just released 0.29.0 which reverts it. It was not a bug, per se, but a different kind of oversight 🧵 github.com/ordinals/ord/r…