🎯 New Report #3819475: Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field
🔺Severity: Medium
👽 Reporter: lilpeko
⭐️ Reputation: 152
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-06-23
⏰ Disclosed: 2026-08-20 23:51:18
📝 Summary: A vulnerability was discovered in the Monero GUI that could allow an attacker to spoof the recipient address for a transaction. The vulnerability was caused by the GUI writing a potentially spoofed address to the recipient field, even when DNSSEC validation failed during an OpenAlias resolution. This could result in funds being sent to an attacker-controlled address if the user proceeded with the transaction.
📂 Report JSON File: 3819475
@hackeronereports