russell@unturf.com
652608142a
All projects with patches now have outreach docs. 276 new docs covering CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#, PHP, Ruby, JavaScript, Dart, Erlang, R, and more. Outreach gap: 276 -> 0.
1.9 KiB
Electrum — CWE-407 Disclosure Brief (electrum-0001)
2026-04-13 · Patch available — awaiting upstream merge
Finding
One O(H*N) linear-scan defect in Electrum's address history callback. Patched. Patch ready for upstream review.
The Defects
electrum-0001 (PATCHED — MEDIUM): electrum/address_synchronizer.py:450
# In receive_history_callback() — fires on every history update:
for tx_hash, height in old_hist.items():
if (tx_hash, height) not in hist: # O(N) scan of list
hist is a list of (tx_hash, height) tuples. The not in check performs O(N) linear scan for each of H old history entries. Total cost: O(H*N).
Complexity Proof
At H=500 old entries, N=500 new entries:
- Defective: 500 x 500 = 250,000 comparisons
- Fixed: 500 x 1 = 500 lookups (set)
- 500x op reduction.
Impact
Electrum is one of the most widely used Bitcoin wallets. Address history callbacks fire during wallet synchronization. Wallets with many transactions accumulate large history lists, making each sync update increasingly expensive.
The Fix
Convert hist to a set before the loop:
# Before
if (tx_hash, height) not in hist:
# After
hist_set = set(hist)
if (tx_hash, height) not in hist_set:
Patch
Fix available: defects/electrum-0001/patch/electrum-0001.patch
Single-file patch on electrum/address_synchronizer.py. 500x speedup at N=500 history entries.
What We Ask
A patch is ready for review.
- Confirm receipt and assign a GitHub issue reference (spesmilo/electrum).
- Assess severity — fires during wallet sync; scales with transaction history.
- Coordinate a disclosure date — we are targeting 90 days from first contact.
- We will credit the Electrum team in the public disclosure. Preferred acknowledgment format welcome.
Contact: see cover email. This brief is confidential until coordinated disclosure.