One protocol level vulnerability that @/dev/fd0 found recently is 
Summary: the directory nodes don't authenticate peer nicks, so peers can impersonate others and steal their connection. For example by updating the onion to their one and by being the newest connection with that nick and getting their messages. Important messages are encrypted, but the impact of "eclipsing" other makers is relevant. No loss of funds, but yes denial of service.
The fix required a protocol fix, that involves makers and directory nodes. My signet directory node is updated with the fix. Directory node runners on mainnet are encouraged to update.
The fix is only for jm-ng, but backwards compatible. So old directories and makers keep working, but are vulnerable to the attack. Good thing is that new directories still benefit old peers by not allowing new connections to steal their nick. But this is not a strong protection.
The full details are at
And the protocol improvement proposal is at 
Thanks to floppy for finding it and to waxwing for helping us understand the issue and design the fix.
GitHub
Directory nick to key mapping can be hijacked by any peer · Issue #577 · joinmarket-ng/joinmarket-ng
Unfinished half of c08daa5. Problem The directory server routes private messages by nick. to_peer = self.peer_registry.get_by_nick(to_nick) get_by_...
GitHub
Directory nick to key mapping can be hijacked by any peer · Issue #577 · joinmarket-ng/joinmarket-ng
Unfinished half of c08daa5. Problem The directory server routes private messages by nick. to_peer = self.peer_registry.get_by_nick(to_nick) get_by_...
GitHub
jmp/jmp-0005.md at main · joinmarket-ng/jmp
JoinMarket Protocol (JMP) Specifications. Contribute to joinmarket-ng/jmp development by creating an account on GitHub.
In this case it was the VPN exit hop. But not everyone uses VPNs, and when you contribute long enough to a project, one day you'll have the VPN off.
I'm sure many people that have contributed to open source projects were not aware of the maintainers being able to see their location. I definitely wasn't.
But there's more! Maintainers can enable collection of IP addresses from the contributors!
I can tell you that it's off for JoinMarket NG, but you would have to trust me about it, because I can't prove it. Same goes for all other organizations you've ever contributed to.
An alternative is 
