Skip to content

Fix merged-mining parent timestamp trust boundary#35

Merged
MoneroOcean merged 1 commit into
masterfrom
codex/fix-child-template-timestamp-vulnerability
Jun 3, 2026
Merged

Fix merged-mining parent timestamp trust boundary#35
MoneroOcean merged 1 commit into
masterfrom
codex/fix-child-template-timestamp-vulnerability

Conversation

@MoneroOcean

Copy link
Copy Markdown
Owner

Motivation

  • The merged-mining path allowed an untrusted child block template to overwrite the parent block header timestamp, which can produce consensus-invalid parent jobs and waste miner hashrate.

Description

  • Remove the child-controlled timestamp overwrite in fillExtraMM so the parent template's consensus-relevant timestamp is no longer mutated by the child template while leaving the merged-mining extra-tag insertion intact.

Testing

  • Inspected src/main.cc before and after the change and validated the offending lines were removed with sed/nl and git diff, and committed the change, all of which succeeded.

Codex Task

@MoneroOcean MoneroOcean merged commit ee7a0b8 into master Jun 3, 2026
3 checks passed
@MoneroOcean MoneroOcean deleted the codex/fix-child-template-timestamp-vulnerability branch June 3, 2026 18:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant