There's a long list of known vulnerabilities in EC schemes, e.g: https://github.com/elikaski/ECC_Attacks

Ironically, for all the talk of how RSA has a lot of "gotchas", EC has a long (longer?) list of its own, and they're not as intuitively obvious as the RSA ones. But most of them are *verifiable* by the other party. So this means nobody is verifying.