v2.1.4

This is a bug fix release addressing mixing reliability issues.

It is highly recommended that all users upgrade from prior releases.

Compatibility notice

Users of the ticket autobuyer who do not mix should take care to configure the changeaccount config option. This option, when set, specifies the name of an account to send change. When unset, it will default to the same as the purchaseaccount. In prior releases, all change from non-mixing ticket autobuying would be redirected to the default account (71a31658).

Bug fixes

• An authentication bypass of the JSON-RPC websocket server was fixed (386d5a0e).

• The mixpool now limits the number of orphan messages to avoid memory exhaustion attacks (decred/dcrd#3606).

• The mixpool and client now impose stricter message size limits to avoid memory exhaustion attacks (decred/dcrd#3655).

• A missing mixpool check for duplicated transaction inputs in pair request messages was corrected. This fix prevents low cost entry to the mixpool and avoids potential memory exhaustion attacks by flooding the pool with messages (decred/dcrd#3656).

• A variable shadowing bug which prevented unknown pair request mixing messages referenced by orphan key exchange messages from being requested by peers under SPV mode was fixed (acdb3694).

• In SPV mode, unique IDs assigned to each peer will no longer be reused by still-connected peers when the next ID (an unsigned 64-bit integer) overflows (e43fbf09).

• Missing mutex protection of the TSpend cache, which could result in a data race, was added (4865ca16).

Changelog

The following lists all commits since dcrwallet v2.1.3:

• 5759db7d: [release-v2.1] Update mixing module to v0.7.2
• fb7b83af: [release-v2.1] Update mixing module to v0.7.1
• 34867813: [release-v2.1] Bump version to 2.1.4+release.local.
• edbe9345: [release-v2.1] Update dcrd modules
• 4865ca16: [release-v2.1] wallet: Add missing mutex lock.
• acdb3694: [release-v2.1] spv: Request unknown PRs from peers.
• 386d5a0e: [release-v2.1] jsonrpc: Fix bugs in authenticate RPC.
• 1fdc4b59: [release-v2.1] Avoid NewMsgTx(); Deserialize() calls
• 03843fff: [release-v2.1] types: Remove non-existent createvotingaccount
• 71a31658: [release-v2.1] Respect --changeaccount with unmixed ticket autobuying
• e43fbf09: [release-v2.1] p2p: Handle peer ID wraparound

Code Contributors (alphabetical order):

• Jamie Holdstock (@jholdstock)
• Josh Rickmar (@jrick)