Dear buttonists!
Our community members have informed us that the Twitter user (arrijabba) has found a vulnerability in our mandala generation mechanism.
We’ve checked his message and found out that there was a possibility to exploit our brute force protection to figure out beforehand which mandalas will be generated from other people’s seeds.
We’ve fixed this problem, but it is unknown how many seeds have been compromised because of it. There was a probability to predetermine which mandala is generated from a given seed regardless of when the actual owner presses the Create Mandala button. The same applies to the seeds that are yet to be created.
Since we don’t know how much the mandala generation system might have been tempered with, we decided to move to Tezos Mandala v2. In this version, we will introduce a revised procedure of generating a mandala from the seed with improved security. This solves the problem.
Up until the move to Tezos Mandala v2 is complete, the sales of seeds on our website will be suspended. We’ve asked block explorers to move Tezos mandala white label from our old contract. Please, refrain from buying seeds via the old contract. The Tezos Mandala v2 contract will get the white label as soon as it is deployed. Purchases of mandala seeds on our website will be done using this new contract exclusively. Do not use the old contract to buy mandala seeds.
As we move to Tezos Mandala v2, holders of the Tezos Mandala v1 seeds and mandalas purchased prior to the publication of this statement have three options to choose from:
- If you like the mandala you have, you can move it to Tezos Mandala v2 without changing its id.
- If you don’t like the mandala or if you think it could’ve been compromised, you can swap it for a seed with the same id in Tezos Mandala v2.
- You can also refund your tez in exchange for burning your seeds and mandalas (minus the refund transaction fee).
All Tezos Mandala v1 seeds will be eligible for a swap for a Tezos Mandala v2 seed with the same id.
The sales of Tezos Mandala v2 seeds will start from the point where we’ve officially stopped the Tezos Mandala v1 sales: seed #569.
Thank you for your vigilance and support. We wouldn’t be able to overcome this challenge without you. We will move to Tezos Mandala v2 ASAP. You will see news on our progress and swap details very soon.
Keep in touch with the team on the Telegram group.
