AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 45 Monero

Tor, Decimal fixes

Public commit record

What the developer wrote

Authored by Justin Ehrenhofer

28/100 · Opaque
Tor, Decimal fixes
✓ Subject identifies a change! No meaningful explanatory body
The short version

What changed, and why it matters

This commit fixes two practical bugs in a Monero wallet app. First, it stops comparing money amounts using floating-point 'double' numbers, which can round incorrectly and let a user think they are sending their full balance when they are not (or vice versa). It now compares exact integer 'piconero' units. Second, it makes the Tor connection logic respect the user's Tor setting: if Tor is set to 'external' or 'disabled', the app no longer blindly tries to start its built-in Tor and waits two minutes. These are correctness/reliability fixes rather than obvious remote-hack vulnerabilities, but they could affect privacy and funds handling.

Recommended action

Review the decimal conversion helper decimalToBaseUnits for overflow/underflow and locale handling, and verify that wallet.unlockedBalanceBaseUnits is populated atomically with the amount field. For the Tor change, confirm that external/disabled modes correctly propagate to all network paths and that returning true for external mode does not bypass proxy usability checks elsewhere.

Security signals we found

01

Floating-point monetary comparison replaced with exact base-unit integer comparison

02

Tor connection startup now gated by user-configured Tor mode, preventing unconditional built-in Tor bootstrap

03

Removal of internal design-document markers (D10/D24/D25/D30) from comments

Risk score

Why this scored 45/100

Our methodology →
Potential impact 12/30
Exploitability 8/25
Stealth signal 6/15
Affected reach 10/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.