Date: Sat, 10 Sep 2022 10:20:48 +0000
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
From: alicexbt <alicexbt@protonmail.com>
Reply-To: alicexbt <alicexbt@protonmail.com>
Message-ID: <uQ5LTbHpJKnhgCIXly1Ft5rq_8HCz4_jkLP2sHrqvjXNrYbrWuCm2MOC4KmQCoPLlC_esQNi38Hman6j2zJYM2xJUq4W_p8lt_-BH1GHmcM=@protonmail.com>
In-Reply-To: <eCSIPVH6QM3r1n0PGBWr39xv4BSyAWx6q0icycfo4mESnQfNg7NJWRu7wwyoxnR6E9Own_CJxGVufqQhqx1H4JyAQil3MUUkdI_kUC5bmVg=@protonmail.com>
References: <eCSIPVH6QM3r1n0PGBWr39xv4BSyAWx6q0icycfo4mESnQfNg7NJWRu7wwyoxnR6E9Own_CJxGVufqQhqx1H4JyAQil3MUUkdI_kUC5bmVg=@protonmail.com>
Feedback-ID: 40602938:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] Full Disclosure: Denial of Service in STONEWALLx2
	(p2p coinjoin)
Precedence: list

This has been assigned CVE-2022-35913: https://www.cve.org/CVERecord?id=3DC=
VE-2022-35913

/dev/fd0

Sent with Proton Mail secure email.

------- Original Message -------
On Thursday, July 14th, 2022 at 9:25 AM, alicexbt via bitcoin-dev <bitcoin-=
dev@lists.linuxfoundation.org> wrote:


> Hi bitcoin-dev list members,
>=20
>=20
> STONEWALLx2[1] is a p2p coinjoin transaction in Samourai wallet. The mine=
r fee is split between both participants of the transaction.
>=20
>=20
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D
> Problem
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D
>=20
> Antoine Riard shared the details of DoS attack in an [email][2] on 21 Jun=
e 2022.
>=20
> Proof of Concept:
>=20
> 1) Download Samourai APK, create testnet wallet, get some coins from fauc=
et and claim a paynym in 2 android devices. Consider Bob and Carol are usin=
g these devices.
>=20
> 2) Bob and Carol follow each other's paynyms. Carol is the attacker in th=
is case and she could make several paynyms.
>=20
> 3) Bob initiates a Stonewallx2 transaction that requires collaboration wi=
th Carol.
>=20
> 4) Carol confirms this request in the app.
>=20
> 5) Carol spends the UTXO from wallet configured in electrum with same see=
d before Bob could complete the last step and broadcast STONEWALLx2 transac=
tion. It was non RBF [transaction][3] with 1 sat/vbyte fee rate and was unc=
onfirmed during testing.
>=20
> 6) Bob receives an [error][4] in the app when trying to broadcast Stonewa=
llx2 transaction which disappears in a few seconds. The [progress bar][5] a=
ppears as if wallet is still trying to broadcast the transaction until Bob =
manually go back or close the app.
>=20
>=20
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D
> Solution
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D
>=20
> Suggestions:
>=20
> a) Error message that states collaborator spent her UTXO used in STONEWAL=
Lx2, end the p2p coinjoin process, unfollow collaborator's paynym and sugge=
st user to do such transactions with trusted users only for a while.
>=20
> b) Once full RBF is used by some nodes and miners, attacker's transaction=
 could be replaced with a higher fee rate.
>=20
> Conclusions by Samourai:
>=20
> a) As the threat involves the collaborator attacking the spender. We stro=
ngly advise that collab spends be done w/ counterparties with which some me=
asure of trust is shared. As such, this does not seem to have an important =
threat surface.
>=20
> b) Bumping fee won't be simple as fees are shared 50/50 for STONEWALLx2 s=
pends. Change would have to be recalculated for both spender and collaborat=
or. Collab would either have had already authorized a possible fee bump bef=
orehand or would have to be prompted before broadcast.
>=20
>=20
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D
> Timeline
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D
>=20
> 22 June 2022: I emailed Antoine after testing STONEWALLx2
>=20
> 23 June 2022: I shared the details of attack in a confidential issue in S=
amourai wallet [repository][6]
>=20
> 07 July 2022: TDevD (Samourai) acknowledged the issue and wanted to discu=
ss it internally with team
>=20
> 14 July 2022: TDevD shared the conclusions
>=20
>=20
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D
> Credits
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D
>=20
> Antoine Riard discovered DoS vector in p2p coinjoin transactions and help=
ed by responding to emails during testing.
>=20
>=20
> [1]: https://docs.samourai.io/spend-tools
> [2]: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-June/02=
0595.html
> [3]: https://mempool.space/testnet/tx/42db696460a46f196f457779d60acbf46b3=
1accc5414b9eac54b2e785d4c1cbb
> [4]: https://i.imgur.com/6uf3VJn.png
> [5]: https://i.imgur.com/W6ITl4G.gif
> [6]: https://code.samourai.io/wallet/samourai-wallet-android
>=20
>=20
> /dev/fd0
>=20
>=20
> Sent with Proton Mail secure email.
>=20
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev