🎯 New Report #3723315: wallet-rpc describe transfer uses real output in tx index instead of real output: cold-wallet pre-sign review shows wrong ring member
🔺Severity: Medium
👽 Reporter: bebensap
⭐️ Reputation: 1026
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-05-09
⏰ Disclosed: 2026-08-05 10:23:08
📝 Summary: The wallet-rpc method "describe transfer" was found to use the wrong index when retrieving information about the ring members for each input. Instead of using the "real output" index, which represents the position of the real entry in the ring, it used the "real output in tx index", which represents the position of the output in the source transaction. This resulted in the pre-sign review displaying the wrong information about the ring members to the cold-wallet operator. The signing process itself was not affected, as the correct ring members were used when constructing the transaction. The vulnerability was present in the master branch and the release-v0.18 branch of the monero-project/monero repository.
📂 Report JSON File: 3723315
@hackeronereports