Indeed, an actual vulnerability needs yet to be proven. Although improbable, dci could technically still come up with something. What i miss from the iota foundation though, is a disclosure of audit results done by external cryptographers, as they claim in the leaked emails. This would effectively end this tiring controversy...