Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Priority: P2 — NUT-13 residue-collision guard is dead code in gonuts v0.13.0 (Conduition disclosure): CheckCollidingKeysets never invoked; wallet-level fix belongs in gonuts-tollgate, tracked here

オープン
  • 何か問題がありますか？
#705 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
32/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
go
領域
backend, security

調査の方向性

Start by tracing keyset registration and persistence in AddMint, keyset refresh, and restore, then locate CheckCollidingKeysets and the existing SaveKeyset guard. The issue requires checking every registration path and adding tests for collisions, unaffected non-colliding registration, rotation, and partial-state prevention; done means collisions are refused before state is written. The proposed keyset-ID verification also needs validation against the applicable ID variants.

索引モデルが issue の本文から書いたものです。

説明

area: payments release:post-0.6.0

What (all refs at tag v0.13.0)

The deterministic-derivation implementation is exactly the BIP32 shape the Conduition NUT-13 disclosure (https://conduition.io/code/cashu-disclosure/, 2026-01, bounty-paid) describes as attackable, and the mitigation that already exists in this repo is never invoked:

  • cashu/nuts/nut13/nut13.go:24,40 — the keyset ID is reduced mod (2^31 - 1) to keyset_id_int
  • nut13.go:51-63 — path m/129372'/0'/keyset_id_int'
  • nut13.go:94-116 / :72-75 — DeriveSecret = .../counter'/0, DeriveBlindingFactor = .../counter'/1
  • nut13.go:119-143 — CheckCollidingKeysets(currentKeysetIds, newMintKeysetIds) implements precisely the disclosure's short-term fix (refuse keysets whose 2^31 - 1 residues collide; also refuses exact duplicate IDs across mints) — and a grep across the whole module (wallet, mint, cmd, tests) finds zero call sites. Dead code.
  • No wallet-path verification that a mint-fetched keyset ID actually derives from the mint's published keys (DeriveKeysetId) — only per-proof DLEQ checks, which do not constrain the ID.

Why it matters

Per the disclosure: a malicious mint can pick a keyset ID whose 31-bit residue collides with a target mint's; a wallet that transacts with both then derives the same secrets and blinding factors for both keysets, and the malicious mint can use the target mint's NUT-09 /restore endpoint as an oracle to harvest blind signatures and construct valid proofs at the target mint. Most NUT-13 wallets were affected; the short-term fix advised for every wallet is exactly the collision guard this repo already has, unwired.

TollGate-side exposure (context from OpenTollGate/tollgate-module-basic-go#703 item 7): mints are operator-curated (accepted_mints + trust allow/blocklists) and the daemon does not auto-transfer between mints, so the no-user-interaction variant does not apply. The realistic vector is an operator running an untrusted mint alongside an honest one. Moderate severity; not a release blocker; the wiring is small.

Proposed fix

  1. Wire the existing guard into every keyset-registration writer — AddMint, keyset refresh, and restore: before persisting a new keyset, run CheckCollidingKeysets against all already-registered keysets; on collision, refuse registration with an error naming both mints and both IDs. This follows the same pattern as the SaveKeyset monotonic-counter guard (the #480/#496 writer-audit class: a guard that exists must be on every writer's path).
  2. Cheap hardening: verify mint-fetched keyset IDs against DeriveKeysetId(pubkeys) where the ID variant permits, rejecting forged IDs at registration.
  3. Explicitly not proposed now: switching derivation to the disclosure's long-term fix (single HMAC over full keyset ID + counter, no BIP32 path). That changes every derived secret and silently invalidates determinism for existing wallets' counter ranges — it needs a versioned derivation plus a migration design, not a patch. Note also that V2 keyset IDs alone do not fix this: keysetIdToBigInt funnels V2 IDs through the same 2^31 - 1 residue.

Required tests

  • Registering a second mint with a residue-colliding keyset ID → refused, error names both mints/IDs.
  • Non-colliding multi-mint registration unaffected.
  • The collision check runs before any counter or derivation state is written (registration refusal leaves no partial state).
  • Keyset rotation/refresh that produces a colliding ID → refused.
  • An attacker-chosen ID that does not hash to the mint's published keys → rejected by the verification in fix 2.

References

  • Disclosure: https://conduition.io/code/cashu-disclosure/
  • Short-term/long-term fix definitions quoted in the disclosure ("Improving security of keyset IDs", "keyset ID v2")
  • TollGate tracking: OpenTollGate/tollgate-module-basic-go#703 (fund-safety program, deep-dive item 7), #665 (pre-tag readiness — this audit's report)
  • Amperstrand/cashu-audit — divergence database context
主要言語
Go
スター
12
フォーク
14
平均マージ
1日 6時間
マージ済み PR（30日）
217

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

OpenTollGate/tollgate-module-basic-go のほかの issue

OpenTollGate/tollgate-module-basic-go の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。