The Flow Foundation has released a report explaining a security flaw that led to the creation of fake tokens on December 27 .