Monero

This change alters how Monero processes batches of incoming blocks. Previously, if any block in a batch was already known, the code would skip fully parsing the remaining blocks. Now it parses all blocks regardless. This could have hidden a bug where incomplete parsing led to inconsistent state, but the patch itself is small and the exact security impact is not stated by the vendor.

This commit fixes a bug in how Monero nodes request blocks from peers during blockchain synchronization. Before the fix, a node could accidentally reserve the same range of blocks twice from different peers, wasting bandwidth and potentially causing synchronization confusion. The fix adds a check to skip over any block ranges that are already reserved. A new test confirms the behavior.

This Monero commit changes how a node calculates the size of upcoming block batches during sync. Previously, when a peer sent 'pruned' blocks (a compressed form), the node did not fully count those blocks toward its sync-size budget and only checked that their reported weight was non-zero. The patch makes the node use the pruned blocks' reported weights in its size calculations and verifies those weights against data already stored in its own chain. The main effect is to prevent a malicious or buggy peer from making the node request far more data than expected, which could slow or disrupt syncing. It is a hardening/DoS-mitigation change rather than a direct coin-theft bug.

This Monero commit rewrites how the peer-to-peer block download queue is limited. Instead of capping the number of 'spans' (batches) of blocks, it now caps the total number of queued blocks based on the measured download speed and a user-configurable target time. The change also fixes a couple of small arithmetic edge cases, such as avoiding division by zero when measuring microseconds and guarding against invalid or infinite block rates. The commit message and diff do not describe any security bug; it reads as a performance and robustness improvement to sync behavior.

This is a one-line change that initializes two local variables to zero to silence a compiler warning. It does not alter program logic or fix a security bug.

This commit removes the entire translation/internationalization system from the Monero command-line tools. It deletes translation files, build scripts, documentation, and the code that loaded and applied translated text. The remaining code now always displays English text. There is no security fix or vulnerability here; it is a feature-removal cleanup change.

This commit adds the Rust programming language and its Cargo package manager to the Guix build environment manifest used for reproducible builds. It is a build-system dependency addition with no visible security fix or vulnerability.

This commit is a routine cleanup that removes unused functions, type aliases, and unreachable code from Monero's core blockchain and transaction-pool modules. The removed code had no callers, so the change cannot be used to attack the network or users. It is purely a maintenance refactor.

This commit is titled as a cleanup of a single RingCT function (proveRctCLSAGSimple), but the supplied diff is actually a massive repository import/addition of 1,360 files (696,994 insertions) including the entire Monero codebase, build system, CI workflows, documentation, tests, and submodules. There is no actual code change to proveRctCLSAGSimple visible in the provided diff. No security-relevant change is present in the materials supplied.

This patch changes how Monero's peer-to-peer networking layer handles bad or rejected messages. Previously, when a message handler decided to drop a peer, it often returned a generic success-like code (1) or a 'handler not defined' error. The patch makes these handlers return a specific connection error code, and makes the lower-level protocol stop processing further buffered messages from that peer when it sees a fatal error. This prevents a misbehaving or malicious peer from forcing the node to keep handling queued messages after the node has already decided to disconnect. The change also ensures notifications (one-way messages) return OK instead of a handler-not-defined error when a command is filtered, avoiding spurious errors.

This commit only adds a temporary debug-logging knob for a DNS library during a unit test. It does not change production behavior, fix a vulnerability, or introduce an obvious security flaw.

This change adjusts the Monero command-line wallet's setup flow when creating a wallet from a hardware device. Previously, if the user answered anything other than 'yes' to a confirmation prompt, wallet creation was aborted. Now, if the user answers 'no', wallet creation continues but the wallet is told not to start scanning the blockchain from a specific estimated height. This could cause the wallet to scan from the beginning of the chain, which may be slower and could potentially reveal more information about the user's transaction history than intended. It is a usability and privacy-related change rather than a direct exploit.

This commit fixes a simple arithmetic bug in how long a transaction has been waiting in the memory pool ("time in pool") was calculated. The old code subtracted the current time from the receive time in the wrong order, which could produce a very large, nonsensical age value instead of a small positive number. The fix ensures the age is always the current time minus the receive time, or zero if the clock somehow runs backward. This is a correctness fix for statistics/ranking of pending transactions, not a direct funds-theft or code-execution vulnerability.

This commit adds an overflow check when the Monero wallet calculates transaction fees from a transaction's weight. Before the patch, multiplying a large 'weight' value by a non-zero 'base_fee' could silently wrap around to a tiny number, potentially causing the wallet to propose an incorrect (possibly far too low) fee. The fix now throws an internal wallet error instead of silently producing a wrong result.

This commit changes how Monero's Trezor hardware wallet integration handles one specific error. Previously, if a user cancelled the view-key export on their Trezor device, the code fell through to a generic 'Get secret keys exception' message and returned false. Now it immediately throws a clearer error: 'Key export rejected on device.' This is a user-experience and diagnostic improvement, not a fix for an exploitable security flaw.

This commit changes a single user-facing message in Monero's simplewallet from 'Device requires attention' to 'Device requests confirmation'. It is purely a wording clarification for hardware wallet prompts and has no security or functional effect on the code.

This commit fixes a bug in Monero's command-line wallet (simplewallet) when creating a wallet from a hardware device. Previously, if the user provided a restore date but no restore block height, the wallet ignored the date and started scanning from the current blockchain tip. This could cause the wallet to miss older transactions and make the user think funds were lost. The fix makes the wallet correctly convert the restore date into a block height and scan from there.