keep-core - reportUnauthorizedSigning fraud proof is not bound to reporter and can be front-run
An attacker can monitor `reportUnauthorizedSigning()` for fraud reports and attempt to front-run the original call in an effort to be the first one reporting the fraud and be rewarded 5% of the total seized amount.\\n```\\n/\\*\\*\\n \\* @dev Reports unauthorized signing for the provided group. Must provide\\n \\* a valid signature of the group address as a message. Successful signature\\n \\* verification means the private key has been leaked and all group members\\n \\* should be punished by seizing their tokens. The submitter of this proof is\\n \\* rewarded with 5% of the total seized amount scaled by the reward adjustment\\n \\* parameter and the rest 95% is burned.\\n \\*/\\nfunction reportUnauthorizedSigning(\\n    uint256 groupIndex,\\n    bytes memory signedGroupPubKey\\n) public {\\n    groups.reportUnauthorizedSigning(groupIndex, signedGroupPubKey, minimumStake);\\n}\\n```\\n
Require the reporter to include `msg.sender` in the signature proving the fraud or implement a two-step commit/reveal scheme to counter front-running opportunities by forcing a reporter to secretly commit the fraud parameters in one block and reveal them in another.
```\\n/\\*\\*\\n \\* @dev Reports unauthorized signing for the provided group. Must provide\\n \\* a valid signature of the group address as a message. Successful signature\\n \\* verification means the private key has been leaked and all group members\\n \\* should be punished by seizing their tokens. The submitter of this proof is\\n \\* rewarded with 5% of the total seized amount scaled by the reward adjustment\\n \\* parameter and the rest 95% is burned.\\n \\*/\\nfunction reportUnauthorizedSigning(\\n    uint256 groupIndex,\\n    bytes memory signedGroupPubKey\\n) public {\\n    groups.reportUnauthorizedSigning(groupIndex, signedGroupPubKey, minimumStake);\\n}\\n```\\n