So they were caching range proofs and it's a caching bug? Like in that they bypass verification of the rangeproof on a cache hit? That's what I'm seeing now. If so, that's... terrible? This patch seems to be the fix:

GitHub

fix: range proof cache bind to asset and scriptpubkey · ElementsProject/elements@c26d719

Open-source implementation of advanced blockchain features extending the Bitcoin protocol - fix: range proof cache bind to asset and scriptpubkey �...