bisq/core
Steven Barclay efd590b9e7
Fix BSQ swap buyer tx fee theft vulnerability
Prevent the seller from stealing the combined tx fee as change by lying
about the value of one or more of his BTC inputs, which are passed to
the buyer as raw inputs in the 'BsqSwapFinalizeTxRequest' message.

To this end, add a 'RawTransactionInput::validate' method to check the
'value' field against the output value of the respective spending tx and
run it on every seller input in 'ProcessBsqSwapFinalizeTxRequest', so
that the buyer is no longer just trusting those numbers.

Additionally, check that the spending txIds from the raw BTC inputs
supplied by the seller actually match those of his signed inputs in the
accompanying partially signed tx, thus tying the raw input values to the
seller's tx.
2021-12-04 19:52:07 +01:00
..
.tx Merge core repository at 4597613 2018-09-05 10:48:22 +02:00
src Fix BSQ swap buyer tx fee theft vulnerability 2021-12-04 19:52:07 +01:00
update_translations.sh Add Polish translation 2021-12-01 15:13:57 +01:00