Ultrafastsecp256K1
Monthly
ECDSA adaptor pre-signature verification in UltrafastSecp256k1 before 4.2.0 accepts forged adaptor pre-signatures whose r value is not cryptographically bound to the adaptor point T, allowing a malicious signing counterparty to produce a pre-signature that passes ecdsa_adaptor_verify even though it is not genuinely adaptable. This is an integrity-only cryptographic soundness flaw (CVSS 3.1 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) affecting deployments that use the library's ECDSA adaptor-signature path, such as atomic swaps, discreet log contracts, or payment channels. No public exploit code was identified at time of analysis, and it is fully fixed in 4.2.0.
ECDSA adaptor pre-signature verification in UltrafastSecp256k1 before 4.2.0 accepts forged adaptor pre-signatures whose r value is not cryptographically bound to the adaptor point T, allowing a malicious signing counterparty to produce a pre-signature that passes ecdsa_adaptor_verify even though it is not genuinely adaptable. This is an integrity-only cryptographic soundness flaw (CVSS 3.1 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) affecting deployments that use the library's ECDSA adaptor-signature path, such as atomic swaps, discreet log contracts, or payment channels. No public exploit code was identified at time of analysis, and it is fully fixed in 4.2.0.