Monero

This commit updates two documentation and CI files to add the boost-libs package to the list of dependencies needed to build Monero on Arch Linux. It is a build-infrastructure fix, not a code change, and has no direct security relevance.

A single missing 'return' statement was added in Monero's networking code. Without it, after starting an asynchronous network write, the function could continue executing additional code that was only meant to run when no write was started. This could lead to unexpected behavior such as duplicate write operations, connection state corruption, or a crash, but the exact security impact is unclear from the tiny patch alone.

This patch fixes a bug where the Monero daemon could hang during shutdown. The core change is making connection shutdown wait for the cleanup sequence to finish before stopping the network event loop, preventing a race where the event loop stops while shutdown tasks are still running inside it. It is primarily a reliability/availability fix rather than an active remote exploit.

This is a small cleanup in Monero's test code. It removes a custom helper called addressof that was used only in unit tests and replaces it with the standard C++ std::addressof. The change also adds a compile-time check that the tested types have a single, unambiguous memory layout. There is no direct evidence this fixes an active security bug in production code, but it removes a potentially risky custom overload near secret key handling and makes the test stricter.

This commit fixes low-level memory handling bugs in Monero's ChaCha encryption code. The old code read and wrote 32-bit numbers by directly casting byte pointers, which can break strict-aliasing compiler rules and crash or misbehave on processors that require aligned memory access. The fix copies bytes through memory-safe helper functions instead. This is a defensive correctness fix in cryptographic code; the commit message calls it an 'aliasing and alignment' fix but does not describe a specific exploit.

This commit changes a low-level cryptographic helper function in Monero that checks whether a secret scalar number is valid. The original code used direct left bit-shifts on signed integers, which is officially undefined behavior in standard C when the value is negative. The patch replaces those shifts with a helper that either relies on GCC's well-defined behavior or multiplies by a power of two instead. The concern is that undefined behavior in cryptographic code could, in theory, lead to incorrect validation of secret keys, but the commit itself does not describe a concrete exploit or security incident.

This change wraps a blockchain preparation step in a safety net so that if something unexpectedly throws an error, the node still runs cleanup code instead of leaving locks or state in an inconsistent condition. It is a defensive hardening patch rather than a clear fix for a known exploitable bug.

This commit tightens how Monero's built-in HTTP client handles password-based authentication (HTTP Digest). It removes support for an older, weaker mode that did not use a client nonce ('cnonce'), and now always generates a random cnonce using OpenSSL's secure random generator. This makes replay and certain man-in-the-middle attacks against the HTTP client harder. The change also updates the tests to expect the new, stricter behavior.

This commit tightens how Monero's network code reassembles split-up network messages. Previously, when fragments were stitched back together, the code trusted the size written in the message header without checking whether the actual reassembled buffer was at least that large. That could let a malformed message cause the code to read past the end of its buffer. The patch adds a size check and trims the buffer to exactly the claimed size before further processing. A new test confirms the handler now rejects a case where the header claims more data than the fragments actually provide.

This commit adds SOCKS5 proxy support to the Monero daemon and wallet, expanding the older SOCKS4/SOCKS4a support. It introduces new URI parsing for proxy strings, optional username/password authentication, IPv6 support, and new command-line options. The change is a feature addition, not a documented security fix. The code does include some security-relevant notes (for example, warning that proxy credentials may appear in the process list), but nothing in the commit message or diff states that a vulnerability is being patched.

This commit fixes a bug in how Monero builds the 'extra nonce' field inside transaction metadata. Previously, the code always reserved only 2 bytes for the length header, which is wrong for larger nonces because the protocol uses a variable-length integer (varint) that can take more than 1 byte. The patch now correctly calculates how many bytes the length needs and writes it as a proper varint. The bug could corrupt transaction extra data or cause parsing failures when nonces larger than 127 bytes are used, but the maximum allowed nonce size (255 bytes) limits the damage. There is no public statement from the Monero Project calling this a security issue, and no independent researcher is credited.

This commit removes the Boost serialization code for a Monero internal data structure called tx_source_entry. It deletes about 20 lines of code that described how this structure is converted to/from a serialized format. The change appears to be a cleanup or hardening step, not a fix for an active vulnerability. There is no direct evidence in the commit that this change addresses a security bug, and no public references were provided.

This commit changes the Monero build system (Makefile) to fix problems when running builds in parallel. It explicitly tells CMake to generate Unix Makefiles and uses the standard $(MAKE) command instead of cmake --build. There is no security relevance in the diff itself.

This commit renames and rewrites a Monero function used to compute a 'zero-commitment' Pedersen commitment (a cryptographic value that hides transaction amounts). The new implementation uses a precomputed table and a vartime (variable-time) bit-by-bit addition to make the calculation about six times faster. The commit does not claim to fix any security bug, and the diff itself shows no signs of a vulnerability. The main risk is that the new code must produce exactly the same results as the old code, otherwise consensus between nodes could break.

This commit replaces older Boost timer types with newer, more robust standard-library-based timers throughout Monero's networking code. It is primarily a modernization and maintainability change. There is no direct evidence in the commit that it fixes an active security vulnerability, though using the newer timer API can help avoid subtle timing bugs in the long run.

This commit is a routine maintenance update that adds a new blockchain checkpoint and updates version references in documentation. Checkpoints are like agreed-upon 'milestones' in the blockchain that help nodes sync faster and resist certain attacks. There is no indication of a security fix or vulnerability in this change.