Yeah I'm seeing now it's not as simple as that! Which is a relief, but then again I haven't seen the right explanation yet, so I should hold off on that relief ...

Well, yes, an individual tx that was invalid, just not crypto code failing to check it.

So they were caching range proofs and it's a caching bug? Like in that they bypass verification of the rangeproof on a cache hit? That's what I'm seeing now. If so, that's... terrible? This patch seems to be the fix:

GitHub

fix: range proof cache bind to asset and scriptpubkey · ElementsProject/elements@c26d719

Open-source implementation of advanced blockchain features extending the Bitcoin protocol - fix: range proof cache bind to asset and scriptpubkey �...