Blockstream / Blockstream/Jade
Jade on Liquid - sign with sighash ALL | RANGEPROOF
Open
- Dominant language
- C
- Stars
- 496
- Forks
- 127
- PR merge metrics
- No merged PRs in 30d
Description
Signatures returned from Jade are not commiting to rangeproofs. This can cause lock of funds.
Malicious software wallet can generate invalid rangeproof in change output of the transaction using an attacker's blinding key. Then the user will not be able to unblind change output and will not be able to spend this money.
It's not a loss of funds, but certainly lock of funds and an opportunity for ransomware attacks.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.