Also the InstantSend vulnerability was described in more detail at the Dash Conference :
https://www.youtube.com/watch?v=d8ExmIqRqOk(see the 40 minutes marker)
Basicly it has to do with how InstantSend can revert back to previous blocks (even after it got confirmed through proof of work).
A masternode owner with six masternodes could take advantage of that by calculating high scores for their own masternodes
by making a lot of InstantSend transactions offline.
Currently the fix to that vulnerability is :
* making it impossible for Instantsend to revert back to older blocks
* the calculatescore now includes a need for 15 confirmations, before it can calculate the score. This means a pack of 6 masternodes can not calculate/influence their score
offline anymore.
InstantSend is currently disabled through a spork and will be fixed in Dash update 12.2
Note 1 : as the fix is still work in progress, the code could still be subject to changes.
Note 2 : above mentioned InstandSend vulnerability and the planned fix is what i summarized from the presentation, it could be subject to misinterpretation from my side.
On Aug 30,
we were told the InstantSend fix was "already completed & QA’d."But today's speech confirmed that was a lie.
In truth, the InstantSend fix is still under heavy development and intensive testing.
How embarrassing for Dash to lose InstandSend just as Litecoin/Bitcoin/Decred accomplish instant on-chain atomic transactions and prepare for Lightning.
How utterly humiliating for
Dash to lose almost all its debit card support while Litecoin hooks up with Revolut (
https://twitter.com/SatoshiLite/status/907437039221534720).
tl;dr Dcash is failing while Decred, Litecoin, and Bitcoin are scaling
I might have to give you that one Icey! 
The Instand Send fix was reported to be completed. 
It was news to me too that it now isn't. 
Yes, the Dcash team was caught red-handed lying to the public.
On Sept 24th, some DashHole speaking at some Dash event featuring way too many cringe-inducing blue lights revealed the supposed InstantSend fix is "still being developed and tested and subject to change." That is a blatant contradiction of what bagholders were told 4 weeks ago.
That's the shittiest excuse for not releasing a hotfix I've ever seen. I knew it was BS he moment I read it, and
said so at the time, thus subjecting myself to
the Dash the cult enforcers' 'attack-the-attacker' tactics.
There is no logical way to reconcile the We-Got-This post from Aug 20 with the Sept 24 Don't-Worry-Still-Working-LOL announcement made at the scam convention.
Such intense dishonesty and Marketing-First avarice are par for the Dash course. No wonder vertoe and Amanda left.
This scam is either a honeypot (hence Dash Core's
refusal to use warrant canary best practices even in light of FBI scrutiny) or a scam waiting to be busted by FBI/CFTC/SEC for operating an unlicensed money services business funded by marketing (without risk disclosure) an unregistered HYIP to unaccredited retail investors.
