Honestly, I i'm surprised we have not seen any issues with all of the various crypto assets. Liquid borrows a lot of complexity, and I assume even some code from Ethereum. I imagine there are teams and individuals hammering on various cryptocurrencies day and night. At the same time, it would be smart if attackers were able to attack in a way that is difficult to detect. So it's not to slay the golden goose, so to speak. And honestly, this is an area in which Monero's opacity adds to its attack surface. It seems a bit strange to say, but I hope people are banging on these projects as hard as they can. And I hope some of them are actual white hats who will responsibly and privately disclose to the developers what they find. There are many incentives for finding flaws in the code of various blockchain-based assets.

Monero's additional complexity is definitely more attack surface. And considering we are trying for a major major upgrade this year, I'm a little freaked out. A little surprised we haven't seen a sudden "everybody needs to upgrade their nodes right fucking now" from the devs TBH. But maybe it's actually solid. I know they've been hitting it with the llms, and I'm sure the black hats have also. The vulnerabilities will continue until everybody fixes their shit.

Yeah, back in the day (you may have been there) The community actually crowdfunded professional cryptographers to review changes as they went in. I hope they're still doing this, though. I haven't really kept up. I am with you on these current new changes. I would rather see a more conservative approach. I don't like adding things. My biggest fear when it comes to bugs is a smart black hat who robs the chain it in a way that doesn't overload the network and it's just a constant cash cow because it's going to be very hard to see. This is basically what almost all the exchanges we're doing naked shorting the coin for years. I'm actually trying to figure out ways I might be able to help with attacking it so I can be an actual white hat. I imagine there are some bug bounties. I hope there are.

I think MAGIC has funded four professional reviews of different aspects of the upgrade. I know the Open source development initiative has also done stuff in the past, but I think it's mostly MAGIC now. And there is CSS money for funding the devs and ongoing work. The bug bounty program has 700 XMR in it right now. Here's the link if you want to claim some 🙂

HackerOne

Monero - Vulnerability Disclosure Program | HackerOne

The Monero Vulnerability Disclosure Program enlists the help of the hacker community at HackerOne to make Monero more secure. HackerOne is the #1 h...

Why are one-time-use proofs being cached? Why is the cache key exactly not what is being proven ??

Yeah, there are still various external audits. In some cases they did three different ones.

Would be advisable to do the same for FCMP++

Computationally cheaper

They were saving computational horsepower. But their cashed values had a sort of architectural ambiguity and could be faked out. Once the attacker learned how to take advantage of the cache he was able to bypass the range proof and enter a negative value for LBTC.

From my knowledge there is not much to cache? The range-proof would be TX specific anywayz The only caee it might benefit is mempool / block validation; which is so dumb for a network that could proceed all txs on a toaster