search

cashshuffle / cashshuffle-electron-cash-plugin

Electron cash cash-shuffle plugin
27 stars 13 forks source link

Coins can be stolen, because peer continues after failed address verification #24

Closed real-or-random closed 6 years ago

real-or-random commented 6 years ago

If a peer notices that the own output address is not in __new_addresses, it raises BlameException in https://github.com/cashshuffle/cashshuffle-electron-cash-plugin/blob/bcd9d668dcde92649be78e445da5820ee79b7ffa/shuffle/coin_shuffle.py#L295. Since this exception is caught in the next line, peer continues, eventually signing the transaction with the wrong __new_addresses, leading to potential theft of coins.

clifordsymack commented 6 years ago

@real-or-random Thanks a lot for this review. I should add more test on it for sure

zquestz commented 6 years ago

Thank you for the review. Appreciate more people looking over this. That is why it is still a dev build.

clifordsymack commented 6 years ago

This case processed now.