I just got banned by Immunefi for reporting a real replay attack on LayerZero V2

4 tangou 1 7/18/2025, 4:18:32 PM

I just got banned by Immunefi for reporting a real replay attack on LayerZero V2.

I discovered that lzReceive() allows infinite replays of valid cross-chain messages, due to the lack of guid tracking. This results in repeated token crediting — a critical flaw.

My PoC used real deployed contracts, no forged data. The vulnerability is 100% reproducible.

Instead of investigating, Immunefi rejected my report without a technical rebuttal — and banned me for "complexity poaching".

Full Story: https://medium.com/@tangouvitch/immunefi-banned-me-for-reporting-a-real-replay-attack-in-layerzero-v2-71d5ee0ff102

Do you think this is a valid bug? Was the ban justified? Should Immunefi be held accountable?

Curious to hear what the Ethereum community thinks.

Comments (1)

lompad · 5h ago

Interesting, can this directly be used to make money? Maybe by the employee reading your report?

Edit: Maybe send a report to steve from grc, he loves those kinds of stories.

Asynchrony is not concurrency (kristoff.it)

Silence Is a Commons by Ivan Illich (1983) (davidtinapple.com)

Multiplatform Matrix Multiplication Kernels (burn.dev)

Trying to send a sticker in Steam Chat burned through a month of mobile data (old.reddit.com)

lsr: ls with io_uring (rockorager.dev)

Broadcom to discontinue free Bitnami Helm charts (github.com)

AI capex is so big that it's affecting economic statistics (paulkedrosky.com)

How I keep up with AI progress (blog.nilenso.com)

Replication of Quantum Factorisation Records with a VIC-20, an Abacus, and a Dog (eprint.iacr.org)

Wii U SDBoot1 Exploit “paid the beak” (consolebytes.com)

Trying Guix: A Nixer's impressions (tazj.in)

Show HN: I built library management app for those who outgrew spreadsheets (librari.io)

Mango Health (YC W24) Is Hiring (ycombinator.com)

Show HN: Molab, a cloud-hosted Marimo notebook workspace (molab.marimo.io)

The year of peak might and magic (filfre.net)

CP/M creator Gary Kildall's memoirs released as free download (spectrum.ieee.org)

Show HN: Simulating autonomous drone formations (github.com)

Cancer DNA is detectable in blood years before diagnosis (sciencenews.org)

A New Geometry for Einstein's Theory of Relativity (quantamagazine.org)

Exhausted man defeats AI model in world coding championship (arstechnica.com)

Benben: An audio player for the terminal, written in Common Lisp (chiselapp.com)

Making a StringBuffer in C, and questioning my sanity (briandouglas.ie)

Third patient dies from acute liver failure caused by a Sarepta gene therapy (biocentury.com)

Section 174 is reversed, mostly (newsletter.pragmaticengineer.com)

How to Get Foreign Keys Horribly Wrong (hakibenita.com)

Hundred Rabbits – Low-tech living while sailing the world (100r.co)

I'm Peter Roberts, immigration attorney who does work for YC and startups. AMA

When root meets immutable: OpenBSD chflags vs. log tampering (rsadowski.de)

Hush: Holistic Panoramic 3D Scene Understanding Using Spherical Harmonics (vision3d-lab.github.io)

HathiTrust Digital Library (hathitrust.org)

LibreOffice slams Microsoft for locking in Office users w/ complex file formats (neowin.net)

CoCo1 composite video (leadedsolder.com)

Psilocybin decreases depression and anxiety in cancer patients (2016) (pmc.ncbi.nlm.nih.gov)

Dear valued user, You have reached the error page for the error page (imgur.com)

15 Years of Building Jefit (jefit.com)

Exposed MCP servers across the internet (knostic.ai)

The Art of Roland-Garros (garros.gallery)

Row Polymorphic Programming (stranger.systems)

Ask HN: Any active COBOL devs here? What are you working on?

Canadian Cross (en.wikipedia.org)

Ring reintroduces video sharing with police (theverge.com)

Fully homomorphic encryption and the dawn of a private internet (bozmen.io)

Inspect ANSI control codes and escape sequences (ansi.tools)

A single shot of a flu drug could outperform vaccines (science.org)

Microsoft Confirms the Closure of Its Underwater Data Center (extremetech.com)

TCP-in-UDP Solution (eBPF) (blog.mptcp.dev)

2025.29: What It Takes to Change the Web (stratechery.com)

DIY Telescope Mods That Transformed My Astrophotography (youtube.com)

Ask HN: GCP Outage?

Evolution Mail Users Easily Trackable Part 2 (grepular.com)

I just got banned by Immunefi for reporting a real replay attack on LayerZero V2

Comments (1)