monero-ecosystem / monero-python

A comprehensive Python module for handling Monero cryptocurrency
BSD 3-Clause "New" or "Revised" License
244 stars 80 forks source link

Hex seed overflow on Seed(hex) #129

Open Monero-HackerIndustrial opened 1 year ago

Monero-HackerIndustrial commented 1 year ago

Seed() expects either a string mnemonic or a hex seed. The default hex seed length that the library produces is 32 bytes. If I feed a 128 byte hex seed to Seed() I get a seed phrase of 96 letters. This is a simple interactive python shell showing an example. The output has been commented out.

thirtytwo = "".join(hexlify(urandom(32)).decode("utf-8"))
onetwentyeight = "".join(hexlify(urandom(128)).decode("utf-8"))

Seed(thirtytwo).phrase
#'dotted afoot yellow lofty hiker baffles click ivory dunes shackles axis nozzle fibula anchor illness gables lobster nirvana dapper sake theatrics bicycle pledge corrode lofty'

Seed(onetwentyeight).phrase
#'ugly down beyond atrium nineteen firm atrium feast stacking vials sniff tequila toilet gags smidgen exhale absorb opacity update biology afraid rogue cabin paper pyramid suffice hemlock thorn eels boyfriend gutter happens nuisance haggled nomad public abducts pavements paradise lexicon locker pride cylinder library dreams warped reef awoken roles nineteen bunch cunning legion unafraid obtains village dagger ouch unafraid roared smog ultimate goldfish technical setup orbit lower zigzags hedgehog lion vexed lynx bailed napkin alerts amnesty voyage gesture zippers heels asked malady poaching urgent pioneer bagpipe beyond orange bested mural umpire ensign software ahead paddles byline smidgen'

monero.__version__
#'1.0.2'

len(Seed(onetwentyeight).phrase.split())
#97 
len(Seed(thirtytwo).phrase.split())
#32 

errorInPython

Shouldn't Seed() check that there is no overflow? Overflow seeds are fed directly into the "encode_seed" function. This leads to non standard mnemonic words and could lead to loss of funds.