Security· ★★★· bearish·

ChainSecurity discloses Vultisig flaw that risked full private key leak

  • —Exploit required one compromised signer plus many malicious signing messages
  • —The app retried signing up to three times instead of halting on a malicious-party error
  • —Fixes #5658 (Android) and #5235 (iOS) merged Aug. 21, releases shipped Aug. 25
  • —ChainSecurity did not review the fixes or audit the rest of the protocol
Why it matters: MPC wallets promise safety when one device is compromised; the case shows that guarantee hinges on how apps handle protocol errors.
Source: CryptoSlate
More on this
Markets · Oct 11
GTA 6 Leak Takes Crypto Twist as Anonymous Leaker Ties Full Game Dump to $30M Meme Coin
 Security · Oct 25
Polkadot: Fearless Wallet extension leaked private keys for 20 months
 Security · Oct 8
Suspected private key leak drains $12.5M from 79thVault on BNB Chain