Monero

This commit updates Monero's Trezor hardware wallet integration to match newer Trezor firmware protobuf definitions. It adds support for new device features (brightness, language packs, authenticity proofs, debug tools, etc.), renames some message types, and moves protobuf extension options into a separate file. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a compatibility update to keep Monero working with current Trezor firmware.

This commit adds a new 'weight' field to the Monero wallet RPC command that describes a transaction. It is a routine feature enhancement: the server now reports how large (in bytes/weight units) a transaction is, which helps users estimate fees. There is no indication of a security bug being fixed.

This commit only changes two user-facing text strings in the Monero command-line wallet. It rewords the description of the built-in 'donate' command from 'development team' to 'general fund'. There is no code behavior change, no security fix, and no vulnerability introduced.

This change lets users of Ledger hardware wallets see their private view key in the Monero command-line wallet, something previously hidden with the message 'On device. Not available.' The key is already cached inside the wallet software for normal operation; the patch simply exposes it through the existing `viewkey` command when the user asks. It does not appear to leak the key to anyone else or bypass hardware protections for the spend key.

This change adds a safety check when a Monero wallet verifies a 'reserve proof'—a document that supposedly proves someone owns enough funds without revealing which coins they are. The fix rejects reserve proofs that contain a mathematically invalid 'key image' (the special value zero, or a point outside the allowed cryptographic subgroup). Without this check, a maliciously crafted proof might trick the wallet into accepting or behaving unexpectedly on data that violates the protocol's assumptions.

This change blocks a specific command—signing unsigned transaction files—from being used when a Monero wallet's private keys live on a hardware device (Ledger/Trezor). Before the patch, the software apparently allowed users to attempt this operation, which hardware wallets do not actually support. The patch now returns a clear error instead of proceeding. The risk is that a user or third-party tool could be misled into thinking a transaction was properly signed when it was not, potentially causing loss of funds or a failed/confused workflow. No exploit code is shown in the commit.

This Monero patch changes how block templates are built for restricted RPC users. Before, a remote user calling the get_block_template RPC on a restricted node could receive a block template containing sensitive transactions—specifically transactions that were relayed privately (such as Dandelion++ stem transactions). The patch adds a flag so restricted RPC callers get a template that only includes publicly broadcast transactions, while local/unrestricted callers still get the full template. This reduces information leakage about pending private transactions to untrusted RPC clients.

This commit changes how the Monero build system compiles the protocol buffer compiler (protoc), a developer-only tool used during the build process. It adds a compiler flag to strip debug symbols from the protoc binary. This is a build-hygiene change: it makes the resulting tool smaller and avoids shipping unnecessary debugging information. It does not fix a vulnerability in Monero's runtime code, nor does it change how Monero nodes or wallets behave. At most, it removes a minor information-leakage path (debug symbols could reveal build paths or function names) from a build-time tool, and slightly reduces attack surface by making the binary smaller and simpler.

This commit fixes an off-by-one error in a wallet fee calculation. The original code allowed an index equal to the array size, which could read one element past the end of a fee lookup table. This could cause the wallet to use incorrect fee data or crash, but the commit message only describes it as a 'faulty bounds check' with no security framing.

This commit only changes the text shown to users when Monero's command-line wallet asks yes/no questions. It replaces '(Y/Yes/N/No)' with '[y/N]' to make it clearer that 'No' is the default if the user just presses Enter. There is no security bug being fixed here.

This is a tiny performance tweak in Monero's network code. It changes one function call so that a batch of downloaded blocks is moved rather than copied into an internal queue. There is no security fix here and no indication it addresses a vulnerability.

This commit tightens Monero's connection limits for public IPv6 addresses. Previously, limits were applied per individual IP address, which is ineffective on IPv6 because a single attacker can easily obtain a huge block of addresses (a /64 subnet). The change groups all public IPv6 addresses within the same /64 subnet together for both P2P and RPC connection limits, so they share a single connection allowance. Private, loopback, link-local, and similar special IPv6 addresses are still treated individually.

This is a one-line bug fix in Monero's command-line wallet. The 'sweep_account' command, when asked to sweep all subaddresses of a different account than the one currently selected, accidentally looked at the wrong account's list of subaddresses. This could cause some funds to be left behind or the command to wrongly report that the target account had no spendable balance. It does not let an attacker steal funds; it is a user-facing functional bug that could surprise a wallet user.

This is a small bug fix in Monero's wallet code. When exporting transaction outputs with a special 'all=true' flag, the code could be asked to start from a position beyond the list of stored transfers. That caused a subtraction to underflow (wrap around to a huge number), which made a memory reservation throw an exception with the message 'vector::reserve'. The fix clamps the starting position to the actual number of transfers, preventing the crash and keeping the returned data consistent with what the import function expects.

This patch fixes a bug in how Monero wallets build key images for transaction outputs they own. When a transaction contained an invalid extra public key, the wallet would misalign its internal list of cryptographic derivations. This caused the wallet to either look at the wrong entry or fail to recognize its own output, preventing it from creating a key image. Because anyone can craft a transaction with such an invalid key, this could be used to stop a wallet from spending its own funds. The fix pads the failed derivation with a placeholder so the list stays aligned with output indexes.