Skip to content

Remove Loki tx_extra support and harden vector deserializer#39

Open
MoneroOcean wants to merge 2 commits into
masterfrom
codex/remove-loki-support-completely
Open

Remove Loki tx_extra support and harden vector deserializer#39
MoneroOcean wants to merge 2 commits into
masterfrom
codex/remove-loki-support-completely

Conversation

@MoneroOcean
Copy link
Copy Markdown
Owner

Motivation

  • Address a high-risk DoS vector where newly-registered Loki tx_extra types exposed attacker-controlled std::vector counts that could trigger large reserve allocations during parsing.
  • Project decision: Loki support is no longer required, so eliminating Loki-specific tx_extra types both removes the attack surface and simplifies maintenance.

Description

  • Removed Loki service-node and key-image tx_extra constants, types, serializers, and variant registrations in src/cryptonote_basic/tx_extra.h so those tags are no longer recognized by the parser.
  • Removed the BLOB_TYPE_CRYPTONOTE_LOKI enum entry from src/cryptonote_config.h and updated code paths that previously referenced Loki.
  • Renamed/re-scoped the previous Loki/XTNC naming to XTNC-specific symbols (xtnc_version / xtnc_type) and limited XTNC/transaction-type branches to BLOB_TYPE_CRYPTONOTE_XTNC in src/cryptonote_basic/cryptonote_basic.h and src/main.cc.
  • Mitigated the vector-allocation amplification by removing the pre-parse v.reserve(cnt) call from src/serialization/vector.h, preventing attacker-controlled counts from causing large premature allocations.

Testing

  • Ran rg searches for Loki/service-node/key-image symbols and confirmed no remaining matches (search returned no hits). (succeeded)
  • Ran git diff --check to validate whitespace/diff issues. (succeeded)
  • Attempted npm test but it was blocked by registry access errors (403 Forbidden fetching bech32), so full JS test execution could not complete. (blocked)
  • Attempted a local C++ syntax-only compile but it failed due to missing Boost headers in the environment, so a full native build could not be validated here. (blocked)

Codex Task

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant