Iohk Hydra vulnerabilities
- input-output-hk hydra Malicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commits 8.1 High
- input-output-hk hydra Hydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline 8.1 High
- input-output-hk hydra Hydra's committed UTxOs at Commit validator and UTxOs at Initial validator can be spent arbitrarily by anyone 9.1 Critical
- input-output-hk hydra Snapshot signature not including HeadID will allow replay attacks 6.5 Medium