input-output-hk vulnerabilities

Malicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commits

input-output-hk · hydra

Hydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline

input-output-hk · hydra

Hydra's committed UTxOs at Commit validator and UTxOs at Initial validator can be spent arbitrarily by anyone

input-output-hk · hydra

Snapshot signature not including HeadID will allow replay attacks

input-output-hk · hydra