Optimism disclosed a critical vulnerability in its pre-Lagoon refund path, involving forged refund payloads being accepted without recomputation. The issue was patched before production exploitation, with no funds lost, according to Optimism's governance forum disclosure.