From 31324e26fbd845cfc7c35fef8c162597d1ab8c21 Mon Sep 17 00:00:00 2001 From: raw391 Date: Wed, 3 Jun 2026 16:51:37 +0000 Subject: [PATCH] fix(tx_pool): guard master node lookup before key_image_unlock dereference In tx_pool::add_tx, the key_image_unlock handler calls get_master_node_details(mnode_key) without first verifying that mnode_key is a registered master node. The accessor dereferences the iterator returned by find() unconditionally, so an unknown mnode_key causes a segfault. mnode_key is read from the incoming transactions tx_extra, so it is attacker-controlled. Patch (a) checks existence at the caller via is_master_node() before the lookup, and (b) makes the accessor throw on a missing key so other callsites of get_master_node_details cant hit the same shape. The caller already handles thrown exceptions as failed verification. --- src/cryptonote_core/master_node_list.cpp | 2 ++ src/cryptonote_core/tx_pool.cpp | 2 ++ 2 files changed, 4 insertions(+) diff --git a/src/cryptonote_core/master_node_list.cpp b/src/cryptonote_core/master_node_list.cpp index b6e90a1c8fd..9bef9c2907a 100755 --- a/src/cryptonote_core/master_node_list.cpp +++ b/src/cryptonote_core/master_node_list.cpp @@ -876,6 +876,8 @@ namespace master_nodes master_node_info master_node_list::state_t::get_master_node_details(crypto::public_key mnode_key) { auto it = master_nodes_infos.find(mnode_key); + if (it == master_nodes_infos.end()) + throw std::invalid_argument("get_master_node_details: master node not found"); return *it->second; } diff --git a/src/cryptonote_core/tx_pool.cpp b/src/cryptonote_core/tx_pool.cpp index 28d4170a12f..b29b865b2e7 100755 --- a/src/cryptonote_core/tx_pool.cpp +++ b/src/cryptonote_core/tx_pool.cpp @@ -274,6 +274,8 @@ namespace cryptonote return false; uint64_t block_height = m_blockchain.get_current_blockchain_height(); + if (!m_blockchain.get_master_node_list().is_master_node(mnode_key)) + return false; const master_nodes::master_node_info &node_info = m_blockchain.get_master_node_list().get_master_node_details(mnode_key); for (const auto &contributor : node_info.contributors)