HackerOne Disclosed Reports - 2026-07-20

Low
resolved

Restricted RPC leaks alternative block hashes via /get_alt_blocks_hashes

Bug reported by Connor Carro was disclosed at July 20, 2026, 12:15 am   |   Improper Access Control - Generic

The `/get_alt_blocks_hashes` RPC endpoint was restricted to prevent unintended access to alternative block hashes. The endpoint had previously been unrestricted.