Date: Thu, 14 Jul 2022 09:25:56 +0000
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
From: alicexbt <alicexbt@protonmail.com>
Reply-To: alicexbt <alicexbt@protonmail.com>
Message-ID: <eCSIPVH6QM3r1n0PGBWr39xv4BSyAWx6q0icycfo4mESnQfNg7NJWRu7wwyoxnR6E9Own_CJxGVufqQhqx1H4JyAQil3MUUkdI_kUC5bmVg=@protonmail.com>
Feedback-ID: 40602938:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: [bitcoin-dev] Full Disclosure: Denial of Service in STONEWALLx2
	(p2p coinjoin)
Precedence: list

Hi bitcoin-dev list members,


STONEWALLx2[1] is a p2p coinjoin transaction in Samourai wallet. The miner =
fee is split between both participants of the transaction.


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
Problem
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

Antoine Riard shared the details of DoS attack in an [email][2] on 21 June =
2022.

Proof of Concept:

1) Download Samourai APK, create testnet wallet, get some coins from faucet=
 and claim a paynym in 2 android devices. Consider Bob and Carol are using =
these devices.

2) Bob and Carol follow each other's paynyms. Carol is the attacker in this=
 case and she could make several paynyms.

3) Bob initiates a Stonewallx2 transaction that requires collaboration with=
 Carol.

4) Carol confirms this request in the app.

5) Carol spends the UTXO from wallet configured in electrum with same seed =
before Bob could complete the last step and broadcast STONEWALLx2 transacti=
on. It was non RBF [transaction][3] with 1 sat/vbyte fee rate and was uncon=
firmed during testing.

6) Bob receives an [error][4] in the app when trying to broadcast Stonewall=
x2 transaction which disappears in a few seconds. The [progress bar][5] app=
ears as if wallet is still trying to broadcast the transaction until Bob ma=
nually go back or close the app.


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
Solution
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

Suggestions:

a) Error message that states collaborator spent her UTXO used in STONEWALLx=
2, end the p2p coinjoin process, unfollow collaborator's paynym and suggest=
 user to do such transactions with trusted users only for a while.

b) Once full RBF is used by some nodes and miners, attacker's transaction c=
ould be replaced with a higher fee rate.

Conclusions by Samourai:

a) As the threat involves the collaborator attacking the spender. We strong=
ly advise that collab spends be done w/ counterparties with which some meas=
ure of trust is shared. As such, this does not seem to have an important th=
reat surface.

b) Bumping fee won't be simple as fees are shared 50/50 for STONEWALLx2 spe=
nds. Change would have to be recalculated for both spender and collaborator=
. Collab would either have had already authorized a possible fee bump befor=
ehand or would have to be prompted before broadcast.


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
Timeline
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

22 June 2022: I emailed Antoine after testing STONEWALLx2

23 June 2022: I shared the details of attack in a confidential issue in Sam=
ourai wallet [repository][6]

07 July 2022: TDevD (Samourai) acknowledged the issue and wanted to discuss=
 it internally with team

14 July 2022: TDevD shared the conclusions


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
Credits
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

Antoine Riard discovered DoS vector in p2p coinjoin transactions and helped=
 by responding to emails during testing.


[1]: https://docs.samourai.io/spend-tools
[2]: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-June/0205=
95.html
[3]: https://mempool.space/testnet/tx/42db696460a46f196f457779d60acbf46b31a=
ccc5414b9eac54b2e785d4c1cbb
[4]: https://i.imgur.com/6uf3VJn.png
[5]: https://i.imgur.com/W6ITl4G.gif
[6]: https://code.samourai.io/wallet/samourai-wallet-android


/dev/fd0

Sent with Proton Mail secure email.