GHSA-VQV5-385R-2HF8 Contrast's unauthenticated recovery allows Coordinator impersonation

Impact Recovering coordinators do not verify the seed provided by the recovering party. This allows an attacker to set up a coordinator with a manifest that passes validation, but with a secret seed controlled by the attacker. If network traffic is redirected from the legitimate coordinator to th...

PT-2026-99447

Name of the Vulnerable Software and Affected Versions Contrast versions prior to 1.4.1 Description A recovering Coordinator fails to verify the seed provided by the recovering party. This allows an attacker to establish a rogue Coordinator with a validated manifest but an attacker-controlled secr...

Possible centralization issue around RandProvider

Lines of code Vulnerability details Impact While it is very common for web3 projects to have privileged functions that can only be called by an admin address, special thought should be given to functions that can break core functionality of a project. One such function is...