Cryptonite versions before 1.0.3 are vulnerable to a double public key signing function oracle attack on Ed25519. The vulnerability arises when the signing function accepts an arbitrary public key input without verifying it matches the private key. An attacker with access to the signing mechanism can use multiple public keys and messages to perform cryptanalysis and potentially recover private key parameters. This flaw allows the signing function to be used as an oracle, leaking sensitive key information. A fix is available in version 1.0.3.