Input-output-hk Hydra vulnerabilities
- input-output-hk hydraMalicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commits8.1 High
- input-output-hk hydraHydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline8.1 High
- input-output-hk hydraHydra's committed UTxOs at Commit validator and UTxOs at Initial validator can be spent arbitrarily by anyone9.1 Critical
- input-output-hk hydraSnapshot signature not including HeadID will allow replay attacks6.5 Medium