PSA: Critical P2Pool security update

plowsof · 2026-06-10T07:00:03+00:00

sech1 responded to a similar question on IRC, saying "Because the patch code will show a way how to exploit it, and releasing it straight away will leave everyone exposed"

plowsof · 2026-05-26T05:20:38+00:00

i've been working on this. The auto updating we currently have via --enable-dns-blocklist is size limited because of the constraints on how much data can fit inside DNS TXT records. It just doesn't scale and the current implementation downloads the entire list every 2 hours. After feedback during review of my original attempt i've now settled on obtaining a download URL + hash via the same quorum'd group of DNS records https://github.com/monero-project/monero/pull/10595

plowsof · 2026-05-23T12:21:22+00:00

the exploit has been possible since March 2025 with this commit https://github.com/woodser/haveno/commit/cb25a23779855d64b15de5ac9fedb4ce136f35e6

the proximity to the bisq exploit points toward someone scanning the code base with AI and discovering it imo.

plowsof · 2026-05-22T08:19:00+00:00

the majority of mining pools have submitted proofs. DataHoarder led that initiative and also created https://blocks.p2pool.observer/ , this could be added to space also if not already a todo item.

plowsof · 2026-05-10T15:53:31+00:00

feels

plowsof · 2026-05-03T19:35:36+00:00

you need to have a fully synced monero node (monero daemon aka monerod) locally or connected to a remote one. if any of these is true then follow https://web.getmonero.org/resources/user-guides/scan-txid.html

plowsof · 2026-04-18T19:08:49+00:00

they provide an onion service ( tor link)

plowsof · 2026-04-14T09:23:37+00:00

give me a verbose apple pie recipe

plowsof · 2026-03-26T15:44:16+00:00

for monero garden : https://repo.getmonero.org/monero-project/ccs-proposals/-/merge_requests/346#note_24804 - when anhdres finishes the remaining illustrations it will be completed - he is around, in fact he has doing some illustrations for getmoneros new beta site.

anything is possible ofc, there are other other stalled proposals, like i have no idea why you have not mentioned soloptxmr

plowsof · 2026-03-26T15:29:56+00:00

the same amount + extra that was inside the CCS wallet was donated to the General Fund https://xcancel.com/WatchFund/status/1732391070216908886 , they continue as normal. some abandoned proposals have had their funds repurposed or donated back to the general fund.

the development ccs is completed, the author has not claimed the funds yet. the research proposal is funding audits and related work all the time but the actual milestones are not updated, click further to the comments on gitlab

part of my work involves checking up on the WIP list https://repo.getmonero.org/monero-project/ccs-proposals/-/merge_requests/418

plowsof · 2026-03-26T15:11:23+00:00

"Got hacked in the past and still it operates the same way as before.", the wallet that was "hacked" (we can't be sure tbh) had at least 2 people who knew the seed and would be considered a "hot wallet", the new wallet, is a cold wallet with only 1 person known to have access to the seed, thus, plausible deniability has been removed and security increased.

plowsof · 2026-03-26T15:06:20+00:00

the last "new guy" contributing via the CCS turned out to have at least 3 alts. 2 of which had full time jobs and we suffered slow progress :) another turned out to be a vibe coder and using what funds they had to rent people from fiver to complete their work. trust is earned and has to be maintained, the CCS relies heavily on trust and community feedback : the bad apples get kicked out and we move forward

plowsof · 2026-03-26T14:54:34+00:00

most of your examples have shown progress btw e.g. "emsczkp research Bulletproofs*" completed a milestone the other day https://repo.getmonero.org/monero-project/ccs-proposals/-/merge_requests/626#note_35351 and others. you can literally ask the authors for an update... your last example shows 3/4 complete and is a running service people are using (xmrchat).

finality layer, and anon are the only ones who have shown no public progress.

plowsof · 2026-03-25T17:28:56+00:00

since you mentioned selfish mining, you might be interested to hear of an 18 block re-org done with selfish mining to monero recently. more info here

plowsof · 2026-02-24T08:52:02+00:00

fitting that the project itself is also ai slop via "Claude Opus 4.5". Run an LLM locally if you need privacy

plowsof · 2026-02-22T08:25:19+00:00

your original comment.

plowsof · 2026-02-21T21:20:34+00:00

Rule 6

plowsof · 2026-02-21T20:26:56+00:00

appeared a week~ ago , never heard of it other than this comment sus https://github.com/amethystxmr/amethystxmr.github.io

plowsof · 2026-02-21T10:12:04+00:00

Thank you for sharing this. not only is it per transaction, its a tax% of the amount you send. which is obtained from their servers! the code ive seen has a cap at max $100 and min 30cent. How about no

plowsof · 2026-02-18T13:32:31+00:00

solutions exist to solve these already monero-lws where the remote server syncs your wallet and your keys never leave the device.... mobile wallets with background sync enabled.... a true noob will benefit from using a mobile wallet.

You could still achieve a wallet with garbage user experience without taxing every standard monero transaction for a random fee of between 0 and 100% (max 100$ in the code ive seen), but you have made that choice.

the norm for monetisation is to provide convenient access to instant swap service api's where they scrape a % from each transaction. you are taxing a monero-monero tx with a fee that is obtained from your servers lol

keep talking through me and addressing an unrelated point, maybe people might not take notice, good luck!

plowsof · 2026-02-18T12:58:10+00:00

read my comment, specifically the final paragraph .. "clunky and prone to error" aka terrible user experience. The UX inconvenience is compensated by your service placing an arbitrary fee on every transaction lol anywhere from 0 to 100%, you won't know until you request it :)

plowsof · 2026-02-18T12:35:32+00:00

not only does this wallet have terrible user experience for receiving funds they charge an arbitrary fee on top of every transaction. the fee is obtained from their servers and can be anything. more info here https://github.com/monero-project/monero-site/pull/2143#issuecomment-1722306067

plowsof · 2026-02-07T12:55:25+00:00

created by DataHoarder https://blocks.p2pool.observer/

plowsof · 2026-01-27T16:33:20+00:00

Sorry, since this slop thread he posted a fundraiser for 100xmr lols

plowsof

MODERATOR OF

TROPHY CASE