Monero

This commit simply deletes unused code from Monero's network synchronization module. It removes functions, macros, and declarations that were never called or had no definition. There is no change to active behavior, no bug fix, and no security-relevant change.

This commit simply deletes unused functions and one unused inline helper from Monero's RingCT code. The removed code was never called by any part of the program, so the change cannot introduce or fix a security vulnerability on its own. It is a routine cleanup that reduces clutter and maintenance burden.

This commit updates the bundled RandomX library (used for Monero's mining proof-of-work) from one version to version 1.2.3. The actual code changes are not visible because the diff was not provided, and no security references were supplied. On its own, the commit message only says 'update to v1.2.3' and does not claim to fix any security issue.

This is a large internal cleanup commit in the Monero codebase. It replaces an older scope-guard helper (auto_scope_leave_caller) with a newer, simpler scope_guard type, trims unused #include lines, and replaces a few value-initialization macros with direct C++ syntax. There is no direct evidence in the commit message or diff that this fixes a security vulnerability; it appears to be a refactoring and code-quality improvement. The changes touch many files but do not alter program logic in a way that is obviously exploitable.

This commit removes a custom hash comparison helper that was used to sort transaction hashes in the memory pool data structure. The code now relies on Boost's default comparison for the hash type. There is no visible security change: the removed comparator behaved the same as the standard less-than comparison for the hash data, and no behavior or interface changes are apparent.

This commit adds new cryptographic routines to Monero and renames an existing one. It introduces a new way to derive 'key image generators' (used to prove a coin hasn't been spent twice) and a new 'unbiased' method for hashing data to an elliptic-curve point. The old method is now explicitly labeled 'biased' but remains in use for existing ring signatures. The changes are presented as a research-driven cryptographic improvement, not as a fix for an active bug or vulnerability.

This Monero code change fixes how the /get_blocks.bin RPC endpoint limits the size of transaction-pool data it returns. Previously, the code reused a P2P Levin packet-size constant that does not apply to HTTP RPC responses, and it tried to budget pool data against the size of the block data already sent. The patch removes that size-budget plumbing and instead caps the number of added pool transactions at a fixed maximum (20,000). This is a correctness fix for response-size limiting, but it also removes a cumulative byte-size cap that could, in edge cases, allow very large individual transactions to make responses bigger than intended.

This commit changes how Monero reads 64-bit chunks from cryptographic hashes during difficulty checks. Previously the code cast a byte array directly to a uint64_t pointer, which can violate strict aliasing rules and cause unaligned or misread memory on some platforms. The new code copies the bytes with memcpy first, then converts endianness. This is a correctness and portability fix; it likely prevents subtle consensus bugs where different nodes might interpret a hash's numeric value differently, but the commit itself does not describe any active security incident or exploit.

This commit only changes two error log messages in Monero's blockchain code. It removes the phrase 'dropping connection' from messages that are printed when a peer sends an invalid chain request. The actual behavior—returning false and not dropping the connection—was already in place; the logs were simply inaccurate. There is no security fix here.

This commit adds new cryptographic code to Monero that converts points on the Ed25519 curve into Weierstraß (short Weierstrass) form. It introduces helper functions, new curve constants, and unit tests, but does not appear to fix any known vulnerability. The change is a feature addition for the FCMP++ (Full Chain Membership Proofs) work. There is no direct evidence in the commit or supplied references that this patch addresses a security bug, but any new elliptic-curve conversion code carries implementation-risk that could affect correctness or side-channel resistance if used incorrectly.

This commit adds a new cryptographic safety check for Monero's upcoming FCMP++ (Full Chain Membership Proof) system. It makes sure that certain elliptic-curve points used in transactions are free of small 'torsion' components—mathematical artifacts that can be exploited in some zero-knowledge proof attacks. The patch introduces helper functions to clear torsion and a new validation routine, plus tests. It does not by itself fix a known exploitable bug in live code; it is a defensive hardening measure for a feature that is still being integrated.

This commit fixes a bug in Monero's wallet software where exporting 'key images' (cryptographic proofs that help verify account balances without exposing private keys) could use an outdated cached value instead of the freshly generated correct one. The change ensures the wallet always exports the newly generated key image, and adds a test to confirm this behavior. If the wrong key image were exported, a wallet relying on it could fail to prove ownership of funds correctly, potentially causing accounting errors or denial of service in balance verification.

This commit narrows a long-standing special-case workaround for Monero block 202612. Previously, any new blockchain fork would have inherited a hard-coded proof-of-work hash at that exact height, which could stop nodes from syncing or miners from producing valid blocks if the network's difficulty was higher than the fixed value. The change now applies the workaround only to the known historical mainnet, testnet, and stagenet blocks, so new or private chains compute proof of work normally.

This commit fixes a race condition in Monero's block synchronization code. When multiple threads check which blocks are missing and write newly received blocks to the database at the same time, one thread can read an outdated database height and wrongly conclude that a block is missing. The patch adds a new mutex to synchronize these checks, reducing false 'missing span' reports that could slow or disrupt syncing. The commit message and comments do not frame this as a security vulnerability, but as a correctness/robustness fix.

This commit removes an old, unused way of representing Monero wallet addresses. The old format used a simple checksum that added up bytes, which is weaker than modern formats. The change deletes the legacy parser and the test that checked it still worked. There is no direct evidence this was exploitable, but removing weak legacy code reduces future risk.

This commit removes leftover code that was only used when building Monero with Microsoft Visual C++ (MSVC). It deletes special-case build rules, compiler-specific macros, and Windows-only helper code. There is no change to how Monero handles money, keys, network messages, or cryptography on supported platforms. It is a cleanup change, not a security fix.

This patch fixes a bug in how Monero nodes remember whether they have shared new transactions with peers. If a node received a transaction but shut down before it could broadcast it, the node would previously never try again after restarting, so the transaction could sit forgotten in the node's memory pool. The fix makes the node re-broadcast such unshared transactions during its normal cleanup loop. It also fixes a related timing issue for privacy-preserving 'stem' transactions so they are not permanently blocked from re-broadcasting.

This commit refactors how Monero converts byte strings into elliptic-curve field elements and adds a helper function to 'reduce' oversized field elements back into a safe range. The change is defensive: it separates the low-level byte-to-field conversion from the point-decompression logic and introduces a normalization routine so that outputs of addition/subtraction can safely be reused as inputs to further additions/subtractions. There is no direct evidence in the commit message or diff of an exploitable vulnerability, but the new helper addresses a known class of subtle correctness issues in Curve25519-style field arithmetic.

This commit adds a faster way to compute many mathematical inverses at once in Monero's cryptography code, plus helper functions and tests. It is a performance and code-organization change, not a security fix or vulnerability. There is no evidence in the commit or supplied references that it addresses a security issue.

This commit updates Monero's built-in blockchain checkpoints to match the v0.18.5.1 release. Checkpoints are hard-coded reference points that help nodes quickly verify they are following the correct chain and protect against certain history-rewriting attacks. The README version references are also updated from v0.18.4.1 to v0.18.5.1. There is no code-level vulnerability being patched here; it is a routine network-consistency maintenance update.

This commit refactors how Monero's blockchain code builds a lookup table used when checking incoming blocks. It replaces a slower, manual scan through offsets with a sorted binary search, and removes duplicate amount handling. The change appears to be a performance and correctness cleanup rather than a clear security fix, but the old code's linear search and duplicate-amount logic could theoretically hide or mishandle edge cases in block validation.

This commit is a performance optimization in Monero's transaction-processing code. It changes how the node detects duplicate transactions sent by a peer: instead of comparing the entire transaction data (which uses lots of memory), it compares small SHA-256 fingerprints. It also streamlines how those fingerprints are stored. There is no direct evidence this fixes a security bug, but it removes a memory-pressure path and hardens duplicate detection against subtle blob differences.

This commit only fixes spelling mistakes in comments, documentation, and user-facing error/log strings. No program logic, calculations, or security behavior was changed. It is not a security fix and cannot be exploited.

This commit only adds new software tests (fuzz tests) for Monero's CLSAG ring signature verification code. It does not change any production code that handles transactions, wallets, or network data. Fuzz tests feed random or crafted data to a function to check it behaves safely, but the tests themselves are not a vulnerability or a fix. There is no indication this commit addresses a known security bug.

This commit updates a Monero fuzz test that feeds random or crafted data to the wallet's cold-output import code. It only changes test files and test code; no production wallet or node code is modified. The change makes the fuzzer use the newer, safer import path (import_outputs_from_str) and adds a testnet wallet setup. On its own, this is a test-harness cleanup, not a fix for a live security bug.