|
About the Remediation in Progress category
|
|
0
|
0
|
October 11, 2026
|
|
GhostStaking.stake() direct-claim branch ignores the external-deposit lock, letting any account force funds into an opted-out wallet
|
|
6
|
30
|
October 11, 2026
|
|
[High] Gatekeeper.verify() signature replay: one signature mints phantomRefund GHST forever — permissionless inflation
|
|
6
|
22
|
October 11, 2026
|
|
[CRITICAL] Unlimited Token Minting via Weaver Session Replay
|
|
7
|
36
|
October 11, 2026
|
|
[pallets/weaver] Unbounded mint via distinct out-of-bounds slot_index values: one empty leaf mints without limit (latent; currently unreachable)
|
|
3
|
9
|
October 11, 2026
|
|
Runtime-benchmarks feature compiles out signature-share verification in exodus
|
|
3
|
12
|
October 11, 2026
|
|
[High] Lack of key-epoch invalidation across DKG rotations grants indefinite signing power to retired validator coalitions; missing chainId binding in `Gatekeeper.rotate()` amplifies cross-chain impact
|
|
7
|
46
|
October 10, 2026
|
|
[Critical] UTXO multi-mint via non-canonical varint re-encoding
|
|
5
|
44
|
October 10, 2026
|