🎯 New Report #3693636: wallet-rpc crash via malformed /gettransactions response (empty txs → vector::front() in check tx key / check tx proof)
🔺Severity: High
👽 Reporter: bebensap
⭐️ Reputation: 1026
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-24
⏰ Disclosed: 2026-08-05 10:23:32
📝 Summary: A vulnerability was discovered in the Monero wallet software that could cause the wallet-rpc process to crash when handling a malformed response from the daemon's /gettransactions endpoint. The vulnerability was due to the wallet software making assumptions about the response structure that were not always valid, leading to undefined behavior when attempting to access empty data structures. The crash occurred when the wallet software tried to retrieve metadata from the empty response, causing a segmentation fault.
📂 Report JSON File: 3693636
@hackeronereports