wallet2: normalize account tags before assignment
What the developer wrote
Authored by selsta
wallet2: normalize account tags before assignment
Reported by xmrack and the MAGIC Monero Fund.
What changed, and why it matters
This small change makes the wallet refresh its account-tag list before assigning a tag to accounts. Without this refresh, the wallet might act on stale or inconsistent tag data, which could lead to tags being applied to the wrong accounts or to duplicate/confused labels. The commit message and reporter credit suggest this was treated as a real bug, but the diff itself does not show an obvious exploit path.
Apply the patch. Users who rely on account/subaddress tags should update to a version containing this fix. Wallet developers should review whether other wallet-state mutations similarly assume prior initialization of m_account_tags.
Security signals we found
State consistency fix in wallet tag assignment
Reported by external party (xmrack / MAGIC Monero Fund)
Single-line defensive patch suggesting a narrow bug rather than broad redesign
No explicit security language in commit title or message
Evidence from the diff
The patch adds a call to get_account_tags() at the start of wallet2::set_account_tag(). That method likely loads/normalizes the m_account_tags structure from persistent storage. Previously, set_account_tag() iterated account_indices and updated m_account_tags directly without ensuring the in-memory map was initialized/consistent. The fix prevents state inconsistencies (e.g., empty map, missing entries, or stale data) when assigning tags. The actual security impact depends on what inconsistent states were reachable before; the diff alone does not demonstrate a concrete vulnerability.
Changed components
src/wallet/wallet2.cppwallet2::set_account_tag()Monero account tagging / subaddress label featureInspect captured patch +1 / −0
diff --git a/src/wallet/wallet2.cpp b/src/wallet/wallet2.cpp
index a1508eb..1e69262 100644
--- a/src/wallet/wallet2.cpp
+++ b/src/wallet/wallet2.cpp
@@ -13116,6 +13116,7 @@ const std::pair<std::map<std::string, std::string>, std::vector<std::string>>& w
void wallet2::set_account_tag(const std::set<uint32_t> &account_indices, const std::string& tag)
{
+ get_account_tags();
for (uint32_t account_index : account_indices)
{
THROW_WALLET_EXCEPTION_IF(account_index >= get_num_subaddress_accounts(), error::wallet_internal_error, "Account index out of bound");
Why this scored 36/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.