Back to Vulnerability database

Misreporting of received amount by show_transfers

ID Submit date Publish date Author Score
1 10.26.2018 10.26.2018 8.9

Decription

Due to a flaw in process_new_transaction in wallet2.cpp, if the tx pubkey is present multiple times, it will decode outputs correctly as many times, and add up the amounts. This means the final amount reported by show_transfers will be the actual amount received multiplied by the number of duplicate tx pubkeys present in the transaction extra field. Probably does not work if the recipient expects an integrated address, since someone stripping the payment id and contacting support would be unlikely, so priming the exchange to be suspicious. This was found by investigating a bug report: https://github.com/monero-project/monero/issues/3983. A simple patch fixes this: keeping track of pubkeys already scanned for, and skipping those that were already scanned. Vector: BVSS:1.1/B:N/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/CI:N/II:M/AI:M

Component

Protocol

Platform

Monero

Subclass

Business Logic Missing

Comments