[0.1 XMR per bug] Find significant bugs

[binarybaron]

This is an issue for people to report significant bugs in the software.

"Significant" is defined as what we (@binarybaron and @Einliterflasche) deem significant.

Bugs must be clearly described with references to the code or at the very least very detailed reproduction steps.

This issue also applies to reports "bugs of the codebase". By this I mean reports of things that could be refactored in the codebase. Code parts that might need refinement. Reports must include a rough outline (in natural text) of how the code should be refactored.

Important

If you believe you found a security vulnerability, please DO NOT post about it publicly. Follow the responsible disclosure procedure by submitting a private message. You can do so on GitHub (see the "Security") tab or on matrix (message @einliterflasche2:matrix.org or @binarybaron:matrix.org).

[nopbody]

whats the way of reporting?
making a PR addressing the bug or raising an issue?

[binarybaron]

whats the way of reporting?
making a PR addressing the bug or raising an issue?

All of those options are valid.

[SlowBearDigger]

Found critical vuln
#866

PR:

#868

[sneurlax]

Found critical vuln #866

PR:

#868

It's not good but it's not exactly a critical vulnerability in the protocol itself. If an attacker has read access to your machine you may have issues keeping your funds safe even if the redacted. It's clearly not great redacted and this should be fixed but I just wanted to chime in that I don't really consider it a critical vulnerability of the swap protocol at large but as mentioned in the OP, "bugs of the codebase"

[SlowBearDigger]

Found critical vuln #866
PR:
#868

It's not good but it's not exactly a critical vulnerability in the protocol itself. If an attacker has read access to your machine you may have issues keeping your funds safe even if redacted. It's clearly not great to redacted and this should be fixed but I just wanted to chime in that I don't really consider it a critical vulnerability of the swap protocol at large but as mentioned in the OP, "bugs of the codebase"

@sneurlax thanks for the input

Agree its an impl issue, not core protocol, but redacted lowers exploit barriers (e.g., backups/shared logs). Fits in "codebase bugs", #868 what do you think of the PR?

With that said... I do think it qualifies as critical because redacted

[binarybaron]

Found critical vuln #866

PR:

#868

It's not good but it's not exactly a critical vulnerability in the protocol itself. If an attacker has read access to your machine you may have issues keeping your funds safe even if the redacted. It's clearly not great redacted and this should be fixed but I just wanted to chime in that I don't really consider it a critical vulnerability of the swap protocol at large but as mentioned in the OP, "bugs of the codebase"

I agree. This is not expected behaviour as we should not log private keys but I would not consider it a critical vulnerability.

This issue was also not intended for security reports.

We will still pay out a bounty but please report "security vulnerabilities" privately next time and give us some time to roll out a fix.

Thank you for the report though.