Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Priority: P2 — NUT-13 residue-collision guard is dead code in gonuts v0.13.0 (Conduition disclosure): CheckCollidingKeysets never invoked; wallet-level fix belongs in gonuts-tollgate, tracked here

Đang mở
  • Có gì không ổn?
#705 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

@Amperstrand đang làm issue này rồi.

Từ ngày 8/10/2026.

  • #780 của @Amperstrand — đang mở
  • #781 của @Amperstrand — đang mở

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
32/100
Loại issue
Lỗi
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
go
Lĩnh vực
backend, security

Hướng nghiên cứu

Start by tracing keyset registration and persistence in AddMint, keyset refresh, and restore, then locate CheckCollidingKeysets and the existing SaveKeyset guard. The issue requires checking every registration path and adding tests for collisions, unaffected non-colliding registration, rotation, and partial-state prevention; done means collisions are refused before state is written. The proposed keyset-ID verification also needs validation against the applicable ID variants.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

area: payments release:post-0.6.0

What (all refs at tag v0.13.0)

The deterministic-derivation implementation is exactly the BIP32 shape the Conduition NUT-13 disclosure (https://conduition.io/code/cashu-disclosure/, 2026-01, bounty-paid) describes as attackable, and the mitigation that already exists in this repo is never invoked:

  • cashu/nuts/nut13/nut13.go:24,40 — the keyset ID is reduced mod (2^31 - 1) to keyset_id_int
  • nut13.go:51-63 — path m/129372'/0'/keyset_id_int'
  • nut13.go:94-116 / :72-75 — DeriveSecret = .../counter'/0, DeriveBlindingFactor = .../counter'/1
  • nut13.go:119-143 — CheckCollidingKeysets(currentKeysetIds, newMintKeysetIds) implements precisely the disclosure's short-term fix (refuse keysets whose 2^31 - 1 residues collide; also refuses exact duplicate IDs across mints) — and a grep across the whole module (wallet, mint, cmd, tests) finds zero call sites. Dead code.
  • No wallet-path verification that a mint-fetched keyset ID actually derives from the mint's published keys (DeriveKeysetId) — only per-proof DLEQ checks, which do not constrain the ID.

Why it matters

Per the disclosure: a malicious mint can pick a keyset ID whose 31-bit residue collides with a target mint's; a wallet that transacts with both then derives the same secrets and blinding factors for both keysets, and the malicious mint can use the target mint's NUT-09 /restore endpoint as an oracle to harvest blind signatures and construct valid proofs at the target mint. Most NUT-13 wallets were affected; the short-term fix advised for every wallet is exactly the collision guard this repo already has, unwired.

TollGate-side exposure (context from OpenTollGate/tollgate-module-basic-go#703 item 7): mints are operator-curated (accepted_mints + trust allow/blocklists) and the daemon does not auto-transfer between mints, so the no-user-interaction variant does not apply. The realistic vector is an operator running an untrusted mint alongside an honest one. Moderate severity; not a release blocker; the wiring is small.

Proposed fix

  1. Wire the existing guard into every keyset-registration writer — AddMint, keyset refresh, and restore: before persisting a new keyset, run CheckCollidingKeysets against all already-registered keysets; on collision, refuse registration with an error naming both mints and both IDs. This follows the same pattern as the SaveKeyset monotonic-counter guard (the #480/#496 writer-audit class: a guard that exists must be on every writer's path).
  2. Cheap hardening: verify mint-fetched keyset IDs against DeriveKeysetId(pubkeys) where the ID variant permits, rejecting forged IDs at registration.
  3. Explicitly not proposed now: switching derivation to the disclosure's long-term fix (single HMAC over full keyset ID + counter, no BIP32 path). That changes every derived secret and silently invalidates determinism for existing wallets' counter ranges — it needs a versioned derivation plus a migration design, not a patch. Note also that V2 keyset IDs alone do not fix this: keysetIdToBigInt funnels V2 IDs through the same 2^31 - 1 residue.

Required tests

  • Registering a second mint with a residue-colliding keyset ID → refused, error names both mints/IDs.
  • Non-colliding multi-mint registration unaffected.
  • The collision check runs before any counter or derivation state is written (registration refusal leaves no partial state).
  • Keyset rotation/refresh that produces a colliding ID → refused.
  • An attacker-chosen ID that does not hash to the mint's published keys → rejected by the verification in fix 2.

References

  • Disclosure: https://conduition.io/code/cashu-disclosure/
  • Short-term/long-term fix definitions quoted in the disclosure ("Improving security of keyset IDs", "keyset ID v2")
  • TollGate tracking: OpenTollGate/tollgate-module-basic-go#703 (fund-safety program, deep-dive item 7), #665 (pre-tag readiness — this audit's report)
  • Amperstrand/cashu-audit — divergence database context
Ngôn ngữ chính
Go
Star
12
Fork
14
Merge trung bình
1 ngày 5 giờ
Pull request đã merge (30 ngày)
220

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của OpenTollGate/tollgate-module-basic-go

Tất cả issue của OpenTollGate/tollgate-module-basic-go

Issue tương tự

Thêm issue về Go

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.