🔺Severity: Medium
👽 Reporter: bebensap
⭐️ Reputation: 1026
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-27
⏰ Disclosed: 2026-08-05 10:23:44
📝 Summary: The
check reserve proof function in the Monero codebase was found to sum RingCT ECDH amounts without checking the output commitment. The decoded amount was added to the total without verifying that it matched the commitment, which could allow a malicious prover to claim larger reserves than actually exist on-chain.📂 Report JSON File: 3698862
@hackeronereports