Skip to content

Fix TRTL PoW profile (use Argon2/Chukwa v2) - #149

Merged
MoneroOcean merged 1 commit into
masterfrom
codex/fix-trtl-share-verification-vulnerability
May 21, 2026
Merged

MoneroOcean merged 1 commit into
masterfrom
codex/fix-trtl-share-verification-vulnerability

Conversation

@MoneroOcean

Copy link
Copy Markdown
Owner

Motivation

  • A refactor accidentally registered the TRTL port 11898 with the cn-pico/trtl algorithm and cryptonight_pico verifier, which caused share verification to trust the wrong PoW and allowed invalid TRTL work to be credited.
  • The change restores the historical TRTL PoW (Argon2/Chukwav2 variant 2) so that shares submitted on port 11898 are validated against the correct algorithm and cannot be abused to dilute payout accounting.

Description

  • Change lib/coins/trtl.js to set algo: "argon2/chukwav2" and pow: pow.argon2({ variant: 2 }) while preserving existing pool submit and blob settings in the profile via preset.cryptonoteHeader.
  • Update TRTL perf aliases to ["argon2/chukwav2", "chukwav2"] so performance mapping aligns with the restored algorithm.
  • Add a focused regression test in tests/pool/coin/basics.js that asserts the TRTL profile resolves to Argon2/Chukwa variant 2 and invokes argon2 rather than cryptonight_pico when calling the profile pow.hashBuff.
  • Keep the change minimal and coin-local so other coin profiles and pool logic are unaffected.

Testing

  • Ran syntax checks with node --check lib/coins/trtl.js which succeeded.
  • Ran node --check tests/pool/coin/basics.js and executed a focused Node assertion that invoked the registry/profile pow.hashBuff to confirm it calls argon2 with variant: 2, which succeeded.
  • Attempted to run the full test harness (node --require ./tests/common/test_output_buffer.js --test ... tests/pool/coin/basics.js) but the full harness could not complete due to missing native test dependencies (node-powhash, protocol-buffers) because npm install was blocked by a registry 403, preventing a full test run in this environment.

Codex Task

@MoneroOcean
MoneroOcean merged commit e881be4 into master May 21, 2026
1 check passed
@MoneroOcean
MoneroOcean deleted the codex/fix-trtl-share-verification-vulnerability branch May 21, 2026 22:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant