Monero

This small patch changes Monero's peer-to-peer sync logic so that when the node's estimated target blockchain height suddenly drops, it re-enables 'safe sync mode' if the target is now very close to the node's current height. Safe sync mode is a more conservative way of downloading and verifying blocks. The change is defensive: without it, a node might stay in a faster but less safe sync mode even when the network no longer appears to be far ahead, which could make it more vulnerable to a malicious peer manipulating its view of the chain height. The commit message does not call this a security fix, and no independent researcher is credited.

This commit simply deletes an unused header file and removes its leftover include statement. It is a cleanup change with no functional or security effect on the running software.

This commit only changes two CMake build messages from plain 'message(...)' to 'message(STATUS ...)'. That is a cosmetic/logging change: it tells CMake to print these lines as informational status messages instead of bare output. It does not change any compiled code, cryptographic logic, wallet behavior, or security boundary.

This commit changes how Monero reads payment IDs embedded in transaction data. Previously, the code used a type-casting pointer trick to read the bytes; now it uses memcpy, which is the safer, standard way to copy raw bytes. The change is defensive and reduces the risk of subtle memory alignment or aliasing problems, but the commit itself does not claim to fix an active security bug.

This commit is a routine cleanup that fixes spelling mistakes and typos across comments, error messages, variable names, and documentation strings. None of the changes alter program logic, data handling, or security behavior. The only file rename (instanciations.cpp → instantiations.cpp) is a spelling correction, and the CMakeLists.txt reference is updated to match. There is no security impact.

This commit simply deletes a helper function called power_integral that was not being used anywhere in the code. It is a routine cleanup with no visible security effect.

This commit adds a missing lock around a function that estimates transaction fees. Without the lock, multiple threads could read blockchain data while it is being changed, leading to inconsistent or incorrect fee estimates. The fix prevents this 'data race' by ensuring only one thread accesses the relevant data at a time.

This commit changes how Monero's daemon returns blocks when a remote caller asks for pruned (trimmed-down) block data. Previously, pruned responses omitted a hash for the prunable part of each transaction. Now the daemon fetches and returns that prunable hash alongside the pruned transaction blob. This is a protocol/data-integrity improvement, not an obvious remote exploit, but it touches the RPC layer and changes the data structure passed between the database, core, and RPC server.

This commit fixes a bug in Monero's built-in miner where mining thread #0 was accidentally running in a slower, more secure mode meant for non-mining code. The fix makes all mining threads run with the faster miner-optimized mode. It is a performance bug, not a security vulnerability, and it only affects users who actively use the built-in miner.

This commit is a massive initial import or merge of the entire Monero repository, adding 1,300 files including source code, build scripts, CI workflows, documentation, tests, and submodules. The only actual code change described in the commit message is a tiny addition of a helper function `sc_1()` in the crypto module. There is no indication this is a security patch or fixes any vulnerability.

This commit fixes a C programming rule violation called 'strict aliasing' in Monero's AES encryption helper code. Previously, the code treated a byte buffer as if it were an array of 32-bit integers by casting the pointer directly. The patch copies the bytes into a properly typed local array first. This is a correctness and portability fix; under aggressive compiler optimization, the old code could theoretically produce wrong encryption results or expose subtle bugs, but there is no direct evidence it was exploitable as a security vulnerability.

This commit is a large repository initialization or merge that adds the entire Monero codebase, including build files, CI workflows, documentation, and tests. The commit title mentions unit tests for JSON transaction representation, but the actual diff shows a massive addition of files rather than a focused code change. There is no indication of a security fix or vulnerability being addressed.

This change makes Monero's Ledger hardware wallet integration ask for the private view key only when it is first needed, rather than immediately when connecting. If the user refuses, the software no longer fails and can continue in a slower mode where the Ledger does more cryptographic work. The change also clears the cached view key from memory when disconnecting. It is a usability improvement, not a fix for an active security flaw.

This commit fixes a bug where Monero's transaction creation code did not check whether a hardware wallet device successfully generated the one-time public key and view tag for a transaction output. If the hardware device call failed, the code would continue using uninitialized cryptographic values, which could lead to creating an invalid or insecure transaction. The fix adds an explicit error check that aborts transaction creation if the key generation fails.

This commit is a defensive code cleanup in Monero's transaction verification system. It restructures how a temporary list of extra block transactions (the 'pool supplement') is handled so that callers cannot accidentally forget to mark the list as unverified when adding new transactions. Before, outside code directly inserted transactions and separately reset a verification flag, which created a risk that someone could add a transaction without resetting the flag and potentially use a stale 'already verified' status. Now, adding or clearing transactions automatically resets the flag, and only the dedicated verification function can set it to a valid version. There is no direct evidence in the commit of an actual exploit or bug being fixed, but the change removes a fragile pattern that could lead to consensus or security issues.

This commit fixes a bug in Monero's blockchain code where a node could accidentally report the wrong block size (weight) to a peer. The bug happened because the code used a mismatched index when some requested blocks were missing. A peer receiving the wrong weight might ban the node, hurting network connectivity. The fix also removes an unnecessary database lookup.

This commit fixes a bug in Monero's wallet RPC server where editing an address book entry could accidentally drop or mishandle the payment ID associated with an integrated address. The fix ensures the payment ID flag is preserved correctly, and new tests check that converting between integrated and standard addresses works as expected. In practical terms, this could have caused users to send funds without the intended payment identifier, making transactions harder to track or reconcile.

This commit removes source-code file names and line numbers from Monero's translation files. It is a routine cleanup to make translation updates smaller and less noisy. There is no change to program logic, no bug fix, and no security improvement or regression.

This commit fixes a use-after-free bug in Monero's transaction pool (tx_pool). The code was storing a reference to a transaction ID, then deleting the underlying data structure that held that ID, and later still using the now-stale reference. The fix simply copies the ID value instead of holding a reference, so it remains valid after deletion. This is a memory-safety bug that could cause crashes or, in the worst case, be exploited to manipulate transaction processing, though the commit itself does not describe any exploit.

This commit changes Monero's CI testing workflow to optionally reduce the number of slow-hash iterations during automated pull-request tests, so the tests run faster. It does not change the real Monero mining or transaction verification code used by ordinary nodes or wallets. The production default of about 1 million iterations stays the same unless someone explicitly compiles with a special override flag. The main risk is accidental: if a binary were built with the reduced iteration count and used in production, the proof-of-work would be much weaker. But the commit only applies the override inside GitHub's test runners for pull requests.

This commit replaces older, compiler-specific thread-local storage keywords (__thread) with standard C/C++ ones (thread_local and _Thread_local). It is a portability and standards-compliance cleanup. There is no direct evidence in the commit that this fixes an exploitable security vulnerability.

This commit is a routine code cleanup: it moves some serialization declarations out of a core cryptographic header file into a new dedicated header. There is no indication this fixes a security bug or changes how data is actually processed; it only reorganizes where certain type definitions live to make the codebase easier to maintain.

This commit removes the entire 'pay-to-use RPC' feature from the Monero node software. Previously, node operators could optionally require remote users to do small proof-of-work payments (or mining shares) before serving RPC requests. The patch deletes the payment logic, command-line options, RPC commands, tests, and shell completions. It is a feature-removal cleanup, not a fix for an active vulnerability, and it makes RPC access free again on nodes that had not separately restricted it.

This commit simply deletes an unused experimental utility for building cryptographic transcripts (data-to-be-hashed) in the Seraphis crypto work area. It removes the source files, the CMake build target, and test-suite links. There is no runtime code change, no bug fix, and no security patch.

This commit only fixes the formatting of copyright comments across many source files. It removes blank lines between the copyright line and the license text, adds missing copyright lines, fixes minor whitespace issues, and removes an unused debug macro. There are no changes to program logic, security behavior, or functionality.