All issues

Search results

Predictable bridge-out instance IDs let any caller permanently wedge the committee watcher's bridge-out cursor

Status: Open.

#448 In GOATNetwork/bitvm-node;

· mr-hrydarie opened on Aug 24, 2026

Auth signature does not bind method, path, or body — LOW/MEDIUM

Status: Open.

#447 In GOATNetwork/bitvm-node;

· DQiash opened on Aug 24, 2026

CORS wildcard and public Prometheus metrics — LOW

Status: Open.

#446 In GOATNetwork/bitvm-node;

· DQiash opened on Aug 24, 2026

Unauthenticated data disclosure on the Bridge State Machine (API) — MEDIUM

Status: Open.

#445 In GOATNetwork/bitvm-node;

· DQiash opened on Aug 24, 2026

Unauthenticated state write on the Bridge State Machine (API) — MEDIUM

Status: Open.

#444 In GOATNetwork/bitvm-node;

· DQiash opened on Aug 24, 2026

[Security] finishWithdrawDisproved pays fixed rewards uncapped by actual slash; empty pool reverts entire disprove flow (DoS)

Status: Open.

#438 In GOATNetwork/bitvm-node;

· cilokesteh opened on Aug 21, 2026

[Security] Committee signature replay across deployments: updateOwners digest lacks contract-address & chain-id binding

Status: Open.

#437 In GOATNetwork/bitvm-node;

· cilokesteh opened on Aug 21, 2026

[Security] bridge-out CLI submits LP claimData without binding --btc-address/--amount

Status: Open.

#436 In GOATNetwork/bitvm-node;

· asbestos22 opened on Aug 21, 2026

[Security] Swap claim watcher permanently wedges on Address::from_script of an attacker-chosen output script

Status: Open.

#435 In GOATNetwork/bitvm-node;

· asbestos22 opened on Aug 21, 2026

[Security] detect_kickoff only watches one OperatorDataPushed graph per operator (unauthorized Take1)

Status: Open.

#431 In GOATNetwork/bitvm-node;

· asbestos22 opened on Aug 19, 2026

[Security] Verifier AssertSent skip is one-shot and unbound when pubin is late (unauthorized Take2)

Status: Open.

#430 In GOATNetwork/bitvm-node;

· asbestos22 opened on Aug 19, 2026

[Security] Verifier KickoffSent challenge is one-shot and fail-open (unauthorized Take1)

Status: Open.

#429 In GOATNetwork/bitvm-node;

· asbestos22 opened on Aug 19, 2026