Skip to content

Fix verifier counter leak during stale queue cleanup - #150

Merged
MoneroOcean merged 1 commit into
masterfrom
codex/propose-fix-for-verifier-cleanup-vulnerability
May 21, 2026
Merged

MoneroOcean merged 1 commit into
masterfrom
codex/propose-fix-for-verifier-cleanup-vulnerability

Conversation

@MoneroOcean

Copy link
Copy Markdown
Owner

Motivation

  • The age-based verifier queue cleanup removed expired pending verification tasks without decrementing miner_address_verify, which could let attackers leak per-address pending counts and suppress future verifications for a victim payout address.

Description

  • Decrement miner_address_verify when an expired pending task is removed during the verify queue cleanup in lib/coins/index.js, preserving the existing behavior of calling the task callback with null.
  • This is implemented as a single-line insertion to balance the per-address in-flight counter for tasks that never reach worker start.

Testing

  • No automated tests were executed as part of this rollout.
  • The patch was validated by inspecting the git diff for lib/coins/index.js and committing the change successfully.

Codex Task

@MoneroOcean
MoneroOcean merged commit 7a273a0 into master May 21, 2026
2 checks passed
@MoneroOcean
MoneroOcean deleted the codex/propose-fix-for-verifier-cleanup-vulnerability branch May 21, 2026 22:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant