🎯 New Report #3648638: monero:// deeplink parsing accepts tx amount=(all) and can trigger send-all transaction mode
🔺Severity: Medium
👽 Reporter: qttps
⭐️ Reputation: 130
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-04
⏰ Disclosed: 2026-08-20 23:47:45
📝 Summary: A vulnerability was discovered in the Monero GUI wallet application. The vulnerability allowed an attacker to craft a malicious URI that could be used to trigger a "send-all" transaction mode, where the victim's entire unlocked balance would be transferred to the attacker's address. The vulnerability was caused by improper validation of the "tx amount" parameter in the external "monero://" URI handler, which accepted the literal string "(all)" as a valid amount value. This allowed an attacker to bypass the normal numeric amount validation and reach the send-all transaction flow. The vulnerability was present in the current Monero GUI source code at the time of the report.
📂 Report JSON File: 3648638
@hackeronereports