🎯 New Report #3686283: View-only offline transaction creation bypasses the long-payment-ID privacy block
🔺Severity: Medium
👽 Reporter: qttps
⭐️ Reputation: 130
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-21
⏰ Disclosed: 2026-08-20 23:49:45
📝 Summary: A vulnerability was discovered in the monero-gui wallet software where the view-only offline transaction creation process did not enforce the same protection against long payment IDs as the normal online transaction sending process. This allowed a malicious payment request to include a standalone payment ID, which could then be included in an unsigned offline transaction, potentially exposing the user's transaction metadata.
📂 Report JSON File: 3686283
@hackeronereports