0 sats \ 1 reply \ @ek 7 Sep \ parent \ on: Mercury Layer Vulnerability Disclosures Report bitcoin
Hopefully by the time you’re reading this report, these vulnerabilities have already been fixed and aren’t deployed in any production systems handling real money.
@conduition isn't even sure themselves. This disclosure doesn't look good.
write
preview
43 sats \ 0 replies \ @conduition OP 8 Sep
Well, due to the nature of mercury, it's impossible to know. The key server is a blind-signer which is agnostic to whether its users are on testnet, mainnet, signet, etc.
The vulns themselves are in the client code, and mercury has no insight as to who (if anyone) is running that code, or what networks they're running on. No way to notify them besides publishing.
reply