v2.1.6

This is a bug fix release addressing a mixing deanonymization attack.

The pairing version to specify compatibility with other mixing peers has been increased in this release (decred/dcrd#3765). Wallets running this release will not mix with older wallets, or vice versa.

All users must upgrade from prior releases.

Bug fixes

• A mixing deanonymization attack was prevented with a mixclient protocol update (decred/dcrd#3765).

• A failure to blame mixing peers who wrongly initiated blame assignment was fixed (decred/dcrd#3760).

• Mixpool message removal on session expiry was fixed (decred/dcrd#3683).

• The wallet now refuses to record transactions seen from the network when signature verification of spent wallet outputs fails (c362bea7).

• SPV peers who announce transactions containing inputs spending wallet outputs with failing signature scripts are now disconnected (a46848a5).

• Missing merkle root checks of blocks processed in SPV mode were added (745996b6).

Changelog

The following lists all commits since dcrwallet v2.1.5:

• a6bbb524: [release-v2.1] Bump version to 2.1.6+release.local.
• d5e32660: [release-v2.1] Updating mixing module to v0.7.4.
• 1da19fba: [release-v2.1] wallet: Don't validate already validated blocks.
• 745996b6: [release-v2.1] spv: Validate merkle root for all fetched blocks
• a46848a5: [release-v2.1] spv: Disconnect peer falsely spending owned UTXOs
• c362bea7: [release-v2.1] Validate tx signature before adding to wallet.

Code Contributors (alphabetical order):

• Jamie Holdstock (@jholdstock)
• Josh Rickmar (@jrick)