unyieldinggrace / nanofusion Goto Github PK

https://github.com/unyieldinggrace/nanofusion/blob/master/client/src/model/Phases/MixAnnounceOutputsPhase.js

This might not be exploitable since MixBuildTransactionPathsPhase should only run once but it should be fixed as if it was exploitable it'd allow creating more outputs than inputs (and those extra outputs could have addresses that come first in sorting causing them to be sent to first).

When the RequestForRPoint message is received, the message should include all of the R commitments for all participating pubkeys. All the commitments should be checked before responding with an R Point.

Creating this issue to hopefully unify my posts in discord:

• Key stealing attacks
  • R commitment isn't validated (documented in #1)
  • R value isn't randomly generated each time, so if an attacker retries a mix they can anticipate the R value and effectively bypass the commitment

    nanofusion/client/src/model/Cryptography/BlockSigner.js

    Line 173 in 9102e40

    let zValue = this.cryptoUtils.ByteArrayToHex(blakejs.blake2b(this.cryptoUtils.HexToByteArray(secret)));

  • R value can be requested before the commitments are released

    nanofusion/client/src/model/Client/JointAccountClient.js

    Line 30 in e4adbd1

    this.sessionClient.SubscribeToEvent(EventTypes.ProvideRPoint, this.onPeerProvidesRPoint.bind(this));

• DoS attacks
  • The exit path Receive a -> send back to a, in case b doesn't send, should have at the end of it receive b -> send back to b (the full path being recv a, send a, recv b, send b). This is in case a publishes the exit path even though b did send the funds https://github.com/unyieldinggrace/nanofusion#solving-the-refund-problem
• Identification attacks
  • The server knows everybody right now, and even if the immediate problem was fixed there would be other issues like linking through IPs, MITMing keys, and so forth. Ideally this would use something like a Monero transaction with a ring sig over commitments, and send it via a separate Tor route.
• Maybe others, I haven't read through even most of the code yet