Security analysis of Fiat-Shamir transcript binding in the monero-oxide CLSAG threshold multi-signature implementation. The analysis identifies that omitting individual nonce binding in the signing challenge derivation reduces the protocol to the ROS problem, enabling forged ring signatures. The vulnerability class is correctly described and the attack geometry is valid. Post-disclosure review confirmed that individual nonce binding is provided by the upstream modular-frost dependency via serai-dex/serai (crypto/frost/src/sign.rs), which was not traced during the initial analysis of monero-clsag directly. The proof of concept demonstrates the ROS attack in isolation. Includes formal description of the transcript fork, severity classification, and proposed remediation patch.
David Tsarskykh (Sun,) studied this question.