I just got banned by Immunefi for reporting a real replay attack on LayerZero V2

5•tangou•6mo ago

I just got banned by Immunefi for reporting a real replay attack on LayerZero V2.

I discovered that lzReceive() allows infinite replays of valid cross-chain messages, due to the lack of guid tracking. This results in repeated token crediting — a critical flaw.

My PoC used real deployed contracts, no forged data. The vulnerability is 100% reproducible.

Instead of investigating, Immunefi rejected my report without a technical rebuttal — and banned me for "complexity poaching".

Full Story: https://medium.com/@tangouvitch/immunefi-banned-me-for-reporting-a-real-replay-attack-in-layerzero-v2-71d5ee0ff102

Do you think this is a valid bug? Was the ban justified? Should Immunefi be held accountable?

Curious to hear what the Ethereum community thinks.

Comments

lompad•6mo ago

Interesting, can this directly be used to make money? Maybe by the employee reading your report?

Edit: Maybe send a report to steve from grc, he loves those kinds of stories.

xxHkrPkrxx•6mo ago

Yeah I've spent a lot of time, writing PoC and they keep getting denied depending on the company, why even try to save their asses, and assets if they're going to treat us like this, starting to really get depressed.

Ask HN: Anyone Using a Mac Studio for Local AI/LLM?

Ask HN: Non AI-obsessed tech forums

Ask HN: Ideas for small ways to make the world a better place

Ask HN: 10 months since the Llama-4 release: what happened to Meta AI?

AI Regex Scientist: A self-improving regex solver

Ask HN: Who wants to be hired? (February 2026)

Ask HN: Who is hiring? (February 2026)

Ask HN: Any International Job Boards for International Workers?

Ask HN: Why LLM providers sell access instead of consulting services?

Tell HN: Another round of Zendesk email spam

Ask HN: Is Connecting via SSH Risky?

Ask HN: What is the most complicated Algorithm you came up with yourself?

Ask HN: Has your whole engineering team gone big into AI coding? How's it going?

Ask HN: How does ChatGPT decide which websites to recommend?

Ask HN: Is it just me or are most businesses insane?

Ask HN: Mem0 stores memories, but doesn't learn user patterns

Ask HN: Anyone Seeing YT ads related to chats on ChatGPT?

Ask HN: Does global decoupling from the USA signal comeback of the desktop app?

Ask HN: Is there anyone here who still uses slide rules?

Kernighan on Programming

We built a serverless GPU inference platform with predictable latency

Ask HN: How Did You Validate?

Ask HN: Cheap laptop for Linux without GUI (for writing)

Ask HN: Have you been fired because of AI?

Test management tools for automation heavy teams

Ask HN: Does a good "read it later" app exist?

Ask HN: OpenClaw users, what is your token spend?

Ask HN: Anyone have a "sovereign" solution for phone calls?

Ask HN: Has anybody moved their local community off of Facebook groups?

How do you deal with SEO nowadays?