Monero

This commit simply deletes unused code, comments, and internal statistics counters from the Monero codebase. It does not change any active behavior, fix a bug, or alter how the software processes transactions, blocks, or keys. There is no security issue here.

This commit changes a single log message so that it prints at the less prominent 'Debug' level instead of 'Info' when a peer reports a blockchain height only one block different from the node's own height. It is purely a logging/verbosity tweak and does not alter any network behavior, validation logic, or security mechanism.

This commit fixes a display bug in Monero's command-line wallet. When showing details of a transfer, the number of 'confirmations' was previously calculated using the wrong block height (the spendable-unlock height instead of the transaction's own block height). This could mislead users about how deeply confirmed a transaction was, especially if the transaction had an unusual unlock time. There is no direct evidence this affects funds safety or can be exploited by an attacker.

This commit removes user-controlled JSON content from error and log messages in Monero's epee networking/serialization library. Previously, when the JSON parser failed, it would copy parts of the raw request into log files or error strings. A malicious user could craft JSON containing fake log entries, terminal escape sequences, or misleading text, which might then be written to logs or shown to administrators. The fix replaces those messages with fixed, safe descriptions and escapes any exception text before logging it.

This commit is a routine maintenance update that refreshes Monero's built-in blockchain checkpoints to match the latest v0.18.5.3 release. It changes version strings in documentation and updates two hardcoded checkpoint records to newer block heights and hashes. There is no code logic change and no indication of a security fix or vulnerability.

This change only touches Monero's internal test code. It makes sure automated wallet tests stop background refresh threads before closing the wallet, likely to prevent flaky or crashing tests. There is no indication this fixes a security vulnerability in the actual Monero wallet software that end users run.

This commit is a small performance and code-quality change. It changes several functions that return copies of fixed cryptographic 'generator' values so that they return constant references instead. This avoids making unnecessary copies of values that never change. There is no security issue visible in the diff itself.

This commit changes three special cryptographic constants—named T, U, and V—used in Monero's upcoming FCMP++ privacy protocol. These constants are like fixed 'reference points' on a mathematical curve that the protocol relies on to prove transactions are valid without revealing who sent what. The old values were apparently copied from an outdated source and were wrong; the new values match the updated reference implementation. If the wrong constants had gone live, Monero's privacy proofs could have been broken or forged, potentially allowing someone to create fake coins or trace transactions. The commit itself only updates the byte strings and their sanity-check first bytes; it does not explain how the error was discovered or whether any real funds were at risk.

This Monero wallet RPC patch changes how transaction hashes are reported for incoming transfers that the wallet does not know the source transaction for. Previously, the RPC would return a string of all-zero characters ('0000...0000') as the transaction hash. After the patch, it returns an empty string instead. This is a correctness and API-clarity fix rather than a direct exploit, but returning a fake all-zero hash could have misled downstream software into treating an unknown transfer as a known one.

This commit fixes a thread-safety bug in the Monero wallet. A function that reads the daemon's network address (get_daemon_address) was accessing shared data without holding a lock, while other parts of the code can change that same data under a mutex. The fix adds the missing lock and makes the mutex 'mutable' so it can be locked even in functions that promise not to modify anything. In practice this could lead to race conditions such as reading a partially updated or inconsistent daemon address, which might cause the wallet to connect to the wrong node or behave unpredictably. There is no direct evidence in the commit of an exploitable security outcome such as remote code execution or theft of funds.

This patch fixes two data races in Monero's asynchronous Levin network protocol handler. A data race happens when multiple threads access the same memory at the same time without proper locking, which can cause crashes, hangs, or corrupted state. The fix adds a mutex around shared callback/timer state and removes a separate 'cancel_timer' virtual method that was being called from multiple threads without synchronization. The commit title explicitly calls these 'data races'.

This change fixes a small user-experience bug in Monero's command-line wallet. Previously, if the wallet locked itself after a period of inactivity and the user tried to close it (for example by pressing Ctrl-C while being asked for the password), the program would keep looping and asking for the password, making it hard to exit. Now, when the password prompt is interrupted, the wallet closes cleanly instead.

This change alters how the Monero wallet picks transaction fees when its automatic fee-estimation helper runs into problems. Previously, if the helper failed or got bad data, it returned whatever priority the caller had requested—potentially a high or urgent priority. Now it falls back to the lowest priority ('Unimportant'). This could mean users' transactions get delayed rather than overpaying, and it reduces the chance that an attacker who can feed bad blockchain data to the wallet can trick it into paying inflated fees. It is a defensive hardening fix, not a clear-cut remote exploit.

This change makes the Monero command-line wallet more forgiving when a user provides a restore date but the wallet cannot reach the network daemon to convert that date into a blockchain height. Previously the wallet would quit with an error; now it prints a warning and continues using a default restore height. This is primarily a usability improvement, but it slightly increases the risk that a restored wallet might scan from the wrong (too recent or too old) block height, potentially missing transactions or scanning more than intended until the user manually corrects it.

This commit tightens how the Monero software reads incoming HTTP requests by only accepting method names like GET and POST when written in uppercase. Previously, lowercase or mixed-case versions such as 'get' or 'Post' were also accepted. The change makes the parser follow the HTTP standard more strictly, which can help block unusual requests that might be used to bypass security checks or confuse proxies and firewalls.

This patch fixes a crash in Monero's command-line wallet (simplewallet) when a user runs a 'sweep' command without providing a destination address. Before the fix, the wallet would try to read from an empty list of arguments, likely causing it to crash. The fix adds a simple check: if no address is given, it prints an error and shows usage instructions instead of crashing. This is a reliability bug, not a security vulnerability that allows theft or remote compromise.