multisig: mitigate fund-burning attack #8432
Conversation
| if (not collect_tx_secret_keys(all_tx_secret_keys, tx_secret_key_temp, tx_aux_secret_keys_temp)) | ||
| return false; | ||
|
|
||
| if (reconstruction) |
There was a problem hiding this comment.
Fine as a sanity check, yet could be removed and decrease bandwidth + a source of potential manipulation.
There was a problem hiding this comment.
They can only be removed by introducing a new pending_tx_multisig struct, which is too much for this PR.
| multisig_tx_key_entropy = crypto::null_skey; | ||
| return true; | ||
| } | ||
| FIELD(multisig_tx_key_entropy) |
There was a problem hiding this comment.
Didn't 8149 simply ban old objects when deserializing? Why not do the same here?
There was a problem hiding this comment.
It banned old multisig_sig structs, this is a change to pending_tx which is more generic (used for more than just multisig afaik).
There was a problem hiding this comment.
Thanks for the clarification. And then the multisig builder itself will ban old versions where this is null. Makes sense.
|
Approved, once the serialization discussion happens. Rest looks good 👍 |
To solve this issue (@kayabaNerve), obtain the ephemeral secrets for a multisig tx's outputs from a hash chain starting with a 32-byte entropy provided by the tx initiator plus the key images of the tx's inputs.