Regrettable losses aside, pretty interesting bug in their Merkle forest verifier.
Merkle forests are supposed to be rather simple, actually.
Yet here we are ๐
We need to start formally verifying more parts of ourcode, if not all of it.
The actual root cause is the MMR verifier bug below. The two exact failure points are:
(1) leavesForSubtree(...) excludes a leaf when leaf_index == subtree boundary
(2) CalculateRoot(...) then accepts the next proof node as the subtree root even though no leaf hash was incorporatedMMR verifier bug in MerkleMountainRange: