Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field
该报告还没有中文解读。
原文摘录
摘自原文（12128 字符中的一小部分）
Summary: Monero GUI resolves OpenAlias names through DNS and exposes the DNSSEC result to QML as `true|address` or `false|address`. When DNSSEC validation fails but the TXT record contains a syntactically valid Monero address, `TxUtils.handleOpenAliasResolution()` returns both a warning message and …
原文中的代码
#!/usr/bin/env node
/*
* Lab-safe reproduction that executes the actual monero-gui/js/TxUtils.js
* handleOpenAliasResolution() function with mocked QML globals.
*
* No DNS queries, wallet actions, or Monero network activity are performed.
*/
const fs = require("fs");
const path = …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Monero 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @lilpeko · 版权归作者与 Monero 所有