Cosmos disclosed a bug submitted by strikeout: https://hackerone.com/reports/2094056 – Bounty: $1250 [Source]