🎯 New Report #3621588: Authenticated `unsigned txset` change spoof lets a malicious hot wallet steal cold-signer change
🔺Severity: High
👽 Reporter: usagirabbit
⭐️ Reputation: 163
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-03-22
⏰ Disclosed: 2026-09-16 09:16:41
📝 Summary: A vulnerability was discovered in Monero's wallet code that allowed a malicious or compromised hot/watch-only wallet with the victim wallet's private view key to forge an authenticated unsigned transaction. The forged transaction included an attacker-controlled output that was presented as change, and the offline signer then reconstructed and signed that output as change. This resulted in a direct loss-of-funds issue, as the resulting output was attacker-spendable and not victim-spendable.
📂 Report JSON File: 3621588
@hackeronereports