🎯 New Report #3515557: Loss of multisig funds through single malicious participant's deliberate deception
🔺Severity: Medium
👽 Reporter: k-privacy-enjoyer
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-01-18
⏰ Disclosed: 2026-08-20 23:47:36
📝 Summary: A vulnerability was discovered in the Monero multisig implementation. A single malicious participant of a multisig could trick other users into sending funds multiple times to a certain recipient, which could not be easily distinguished from a legitimate user action. This issue was caused by the inability to view the inputs of partially signed multisig transactions, and the lack of a mechanism to deliberately select the same inputs when re-creating a transaction.
📂 Report JSON File: 3515557
@hackeronereports