GoPlus Security 🚦 (@GoPlusSecurity): 🚨 GoPlus Security Alert:

🚨 GoPlus Security Alert: The Haveno protocol, a P2P multisig DEX protocol designed for Monero ($XMR), contains a vulnerability. Its fork project, @RetoSwap, was attacked, resulting in the theft of approximately 7,000 XMR (≈$2.7M) in user funds. 🔍 The attacker exploited the lack of strict state-machine checks in P2P message handling. By sending forged and out-of-order ACK messages to impersonate an arbitrator, the attacker hijacked the multisig wallet creation process before funds were deposited. ⛔ The RetoSwap team responded quickly, blocked the attacker’s onion address, and suspended the related trading services. ⚠️ The Haveno codebase is affected, and other fork projects may face similar risks. Please conduct an immediate self-check. ⚠️ Privacy Dilemma: Monero’s privacy features make on-chain attacker tracing significantly more difficult. The security of decentralized protocols depends not only on cryptography, but also on rigorously designed state machines. Any oversight in asynchronous message handling can undermine the entire trust model. Please deploy the Haveno patch immediately and upgrade your client. Do not perform any trading operations until the protocol is officially confirmed to be secure.