edit: seems to be this bug letting attacker specify params https://twitter.com/thracky/status/1217175743316348929