AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
High 70 Monero

Fix Firo masternode registration to use external collateral instead of redundantly re-sending 1000 FIRO

Public commit record

What the developer wrote

Authored by Navid Rahimi

50/100 · Thin
Fix Firo masternode registration to use external collateral instead of redundantly re-sending 1000 FIRO
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
The short version

What changed, and why it matters

This commit fixes a bug in Stack Wallet's Firo masternode registration feature. Previously, the wallet would redundantly send another 1000 FIRO inside the registration transaction itself, using that new output as collateral. The updated code instead uses an existing 1000 FIRO unspent output (UTXO) in the wallet as collateral, which is the correct behavior for Firo masternodes. The change also adds checks that the collateral exists, is confirmed, is exactly 1000 FIRO, and is signed with the correct private key. This prevents users from accidentally spending an extra 1000 FIRO and makes the registration compatible with standard Firo masternode requirements.

Recommended action

Review and merge after confirming the ProRegTx serialization, signature format, and collateral outpoint byte order match Firo consensus. Test on Firo testnet or regtest with both P2PKH and P2SH payout addresses, and verify the wallet no longer creates a second 1000 FIRO output. Consider adding unit tests for the payload hash and signature construction.

Security signals we found

01

Fixes incorrect transaction construction that caused an extra 1000 FIRO to be sent

02

Adds validation that collateral UTXO is confirmed, unblocked, unused, and exactly 1000 FIRO

03

Adds signature validation using collateral private key for external collateral

04

Restricts voting and payout addresses to transparent P2PKH/P2SH, rejecting Spark addresses

05

Prevents voting address from matching collateral or payout address

06

Adds user-facing warnings when fee is subtracted from collateral amount

07

Changes masternode discovery to use actual ProRegTx transactions rather than inferring from UTXOs

Risk score

Why this scored 70/100

Our methodology →
Potential impact 25/30
Exploitability 15/25
Stealth signal 8/15
Affected reach 10/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.