AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Moderate 51 Cryptographic libraries

tx_pool: track sensitive flag per-tx in added_txs_by_id

Public commit record

What the developer wrote

Authored by j-berman

73/100 · Adequate
tx_pool: track sensitive flag per-tx in added_txs_by_id

Replace the plain time_t map value with an added_tx_info struct that
stores both receive_time and a sensitive flag. Thread the flag through
all add_tx_to_transient_lists call sites so incremental RPC queries
can skip sensitive transactions.

Reported-by: selsta
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This Monero code change fixes how the transaction memory pool tracks 'sensitive' transactions—those that have not yet been publicly broadcast, such as Dandelion++ stem-phase transactions. Previously, incremental RPC queries could leak these sensitive transactions to clients that should not see them. The patch adds a per-transaction 'sensitive' flag so that RPC responses can skip these transactions. This is a privacy/confidentiality fix, not a direct theft-of-funds bug.

Recommended action

Apply the patch. Review related RPC endpoints that expose mempool contents to ensure the include_sensitive parameter is consistently enforced and that no other paths leak unbroadcast transaction metadata.

Security signals we found

01

Privacy leak prevention for unbroadcast transactions

02

Dandelion++ stem-phase transaction handling

03

Incremental RPC mempool query filtering

04

Per-transaction sensitive flag added to transient pool index

Risk score

Why this scored 51/100

Our methodology →
Potential impact 12/30
Exploitability 8/25
Stealth signal 10/15
Affected reach 10/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.