Authenticated `unsigned_txset` change spoof lets a malicious hot wallet steal cold-signer change
该报告还没有中文解读。
原文摘录
摘自原文（25193 字符中的一小部分）
I found a software cold-signing theft issue in Monero's `unsigned_txset` flow. A malicious or compromised hot/watch-only wallet that has the victim wallet's private view key can forge an authenticated unsigned transaction so that Monero's confirmation surfaces present an attacker-controlled output …
原文中的代码
// tests/unit_tests/cold_signing_change_spoof.cpp
// unrelated include directives omitted for brevity
namespace
{
constexpr char k_unsigned_tx_prefix[] = "Monero unsigned tx set\005";
std::string dump_unsigned_txset_with_view_key(
const tools::wallet2::unsigned_tx_set &unsigned_txs,
const …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Monero 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @usagirabbit · 版权归作者与 Monero 所有