Monero

This is a tiny Python 2-to-3 compatibility fix in a test helper script. It changes an outdated way of joining a list of strings into a modern one. The script only prints a help message listing available tests, so the change has no security relevance and does not affect the Monero wallet, daemon, or any user funds.

This Monero commit adds an optional size check to transaction parsing functions so that oversized transaction blobs from untrusted network sources are rejected before being decoded. It is a defensive hardening change that consolidates existing size checks and extends them to more code paths, reducing the chance that a maliciously large blob could waste resources or trigger memory-related issues during parsing.

This change fixes a bug in Monero's command-line wallet (simplewallet) where a user typing 'index=' in the wrong position of a 'sweep' command could be silently ignored. Previously, the wallet only checked the very first word for 'index='; if it appeared later, the wallet would act as if no subaddress index was specified, potentially sweeping funds from unintended addresses. The fix scans all words for 'index=' and removes it when found. This is primarily a usability/transaction-safety bug rather than a remote-exploitable vulnerability.

This is a build-system patch that lets the Rust part of Monero compile correctly when targeting Linux systems that use the lightweight 'musl' C library (common in Docker containers). It adds a check so the build picks the right Rust toolchain variant. There is no indication this changes any runtime behavior, cryptographic logic, or network code.

This commit changes the order in which Monero checks incoming transactions. Instead of running an expensive consensus check first, it now checks cheaper 'no-drop' rules (like whether the transaction pays a valid fee and isn't already known) before doing the heavy validation. This is a performance and resource-usage optimization, likely to reduce denial-of-service risk from spam transactions. A second small change makes the spent-key-image check skip non-standard input types instead of asserting they never occur. The commit message and diff do not describe this as a security fix, and no independent researcher is credited.

This change fixes a bug in Monero's multisig wallet import process. Previously, if importing multisig data failed partway through, the wallet could be left with a mix of old and new internal state, potentially causing confusion or incorrect behavior on the next import attempt. The patch now validates all incoming data in a temporary staging area and only replaces the wallet's live state after everything checks out, keeping things consistent even when something goes wrong.

This patch fixes a bug in Monero's peer-to-peer networking code. Previously, when the software tried to connect to 'seed nodes' (hardcoded first-contact servers that help a node find the network), it ignored the cache of recently-failed addresses. That meant an unreachable or rejecting seed node could be retried over and over again, wasting resources and potentially delaying or preventing a node from successfully joining the Monero network. The fix makes seed-node connections respect a shorter 5-minute 'cooldown' before retrying a failed seed, while normal peer connections keep the existing 1-hour cooldown.

This change stops the Monero command-line wallet's built-in 'donate' command from working on test networks. Previously, the wallet tried to convert the official donation address to a testnet/stagenet equivalent, which could send real-looking donations to an address the user did not expect. Now it simply refuses to donate unless you are on the main Monero network.

This commit adds a new 'change_amount' field to Monero wallet RPC responses that describe transfers. When you send Monero, part of the input often comes back to you as change. Previously, callers of the wallet RPC had to calculate this themselves from other fields; now it is exposed directly. This is a straightforward feature addition, not a security fix or vulnerability.

This commit refactors how Monero checks whether a new block's timestamp is valid. It splits one timestamp-check function into two: a general helper and one specifically for the main chain. The change also moves the 'future time' check (rejecting blocks stamped more than 2 hours ahead of local time) and the 'not enough blocks' check into the general helper, and it makes the median timestamp output optional. The commit appears to be a code-quality and consistency improvement rather than a clear-cut security fix, but it does tighten behavior when there are fewer than 60 prior blocks and removes a const qualifier from one function. Without a vendor statement, we cannot say it fixes a known vulnerability.

This commit simply adds the Rust programming language toolchain to the project's Docker build environment. It is a routine build-infrastructure change with no apparent security relevance.

This change fixes a peer-to-peer networking timeout behavior. Previously, the handshake timeout timer could be reset by incoming partial data, potentially allowing a remote peer to drag out the handshake indefinitely. Now, the handshake timeout is absolute: if it expires, the connection is dropped regardless of partial progress. This prevents a likely denial-of-service vector where a malicious or slow peer stalls handshakes.

This commit only adds the C++ keyword `static` to a single function declaration in a header file. It does not change what the function does, what data it can access, or how users interact with the software. There is no visible security effect.