Monero

This Monero wallet patch changes how the wallet decides whether an encrypted payment ID is real or a dummy placeholder. Previously, the wallet relied on destination address data (cd.dests), which could be manipulated by a malicious signer or loaded transaction to make a real payment ID look fake, or a fake one look real. The patch now derives that status directly from the transaction's extra field, where the payment ID is actually stored, and adds a consistency check. This is a security fix for a potential information leak or user deception during multi-step transaction signing.

This commit simply deletes unused code from Monero's network synchronization module. It removes functions, macros, and declarations that were never called or had no definition. There is no change to active behavior, no bug fix, and no security-relevant change.

This commit simply deletes unused functions and one unused inline helper from Monero's RingCT code. The removed code was never called by any part of the program, so the change cannot introduce or fix a security vulnerability on its own. It is a routine cleanup that reduces clutter and maintenance burden.

This commit changes a single log message from 'Device inited...' to 'Device initiated...' in the Monero wallet code. It is purely a wording/spelling fix with no functional or security effect.

This is a small cleanup change in Monero's command-line wallet. It moves a call that retrieves a transaction's secret key so it only runs when the user actually asked to export keys. Previously, the key was retrieved for every exported transfer even if keys were not being exported. There is no direct security vulnerability here, but retrieving secret key material unnecessarily is a minor defensive-coding concern.

This commit is a test-infrastructure change for the Monero wallet API. It makes existing integration tests runnable under the automated CTest framework by spinning up a temporary local blockchain instead of relying on external testnet nodes. It also adds a few new test cases and exposes two small helper methods in the wallet API so tests can configure daemon-version mismatch tolerance and a custom ring database path. There is no obvious security vulnerability in the changes, and the commit does not describe itself as a security fix.

This commit updates the bundled RandomX library (used for Monero's mining proof-of-work) from one version to version 1.2.3. The actual code changes are not visible because the diff was not provided, and no security references were supplied. On its own, the commit message only says 'update to v1.2.3' and does not claim to fix any security issue.

This is a large internal cleanup commit in the Monero codebase. It replaces an older scope-guard helper (auto_scope_leave_caller) with a newer, simpler scope_guard type, trims unused #include lines, and replaces a few value-initialization macros with direct C++ syntax. There is no direct evidence in the commit message or diff that this fixes a security vulnerability; it appears to be a refactoring and code-quality improvement. The changes touch many files but do not alter program logic in a way that is obviously exploitable.

This commit removes a custom hash comparison helper that was used to sort transaction hashes in the memory pool data structure. The code now relies on Boost's default comparison for the hash type. There is no visible security change: the removed comparator behaved the same as the standard less-than comparison for the hash data, and no behavior or interface changes are apparent.

This commit adds new cryptographic routines to Monero and renames an existing one. It introduces a new way to derive 'key image generators' (used to prove a coin hasn't been spent twice) and a new 'unbiased' method for hashing data to an elliptic-curve point. The old method is now explicitly labeled 'biased' but remains in use for existing ring signatures. The changes are presented as a research-driven cryptographic improvement, not as a fix for an active bug or vulnerability.

This Monero code change fixes how the /get_blocks.bin RPC endpoint limits the size of transaction-pool data it returns. Previously, the code reused a P2P Levin packet-size constant that does not apply to HTTP RPC responses, and it tried to budget pool data against the size of the block data already sent. The patch removes that size-budget plumbing and instead caps the number of added pool transactions at a fixed maximum (20,000). This is a correctness fix for response-size limiting, but it also removes a cumulative byte-size cap that could, in edge cases, allow very large individual transactions to make responses bigger than intended.

This commit adds a safety check in Monero's wallet code to prevent a crash or undefined behavior when the wallet tries to select decoy transaction outputs but finds none in the expected time window. It also fixes a related unit test that was not correctly simulating a blockchain with only one output. The change is defensive and improves robustness, but the commit message does not describe it as a security fix.

This is a tiny cosmetic fix in Monero's command-line wallet. It removes a stray colon and space from a prompt asking the user whether to enable background mining. The change does not affect security, user funds, cryptography, network behavior, or how user input is interpreted.

This commit fixes a bug in Monero's wallet programming interface (wallet_api). When a wallet was restored from a recovery seed or from private keys, the internal copy of the wallet password was not being saved. As a result, operations that later needed the password—such as saving the wallet to disk—could fail or behave incorrectly. The patch simply records the password in those three recovery code paths and adds tests to confirm that a recovered wallet can be saved and reopened with the same password.