russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.1 KiB

Raw Blame History

Wasabi Wallet — CWE-407 Disclosure Brief (wasabi-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Wasabi Wallet's transaction factory. Any() with compound key comparison performs linear scans for UTXO filtering during transaction construction. Patched.

The Defects

wasabi-0002 (PATCHED — MEDIUM): WalletWasabi/Blockchain/Transactions/TransactionFactory.cs

// In BuildTransaction() — fires per transaction construction:
allowedSmartCoinInputs = allowedSmartCoinInputs
    .Where(x => parameters.AllowedInputs.Any(
        y => y.Hash == x.TransactionId && y.N == x.Index))  // O(A) per coin
    .ToList();

// Second site:
foreach (var coin in availableCoinsView.Where(
    x => !allowedSmartCoinInputs.Any(
        y => x.TransactionId == y.TransactionId && x.Index == y.Index)))  // O(I) per coin

Any() performs O(A) or O(I) linear scan per coin. With C coins and A/I allowed inputs, total cost is O(C × A) per filter operation.

Complexity Proof

wasabi-0002: At C=500 coins, A=200 allowed inputs:

Defective: 500 × 200 = 100,000 compound comparisons
Fixed: 500 × 1 = 500 hash lookups
~200× op reduction per transaction build.

The Fix

wasabi-0002: Use HashSet<OutPoint> for O(1) outpoint membership:

// Before — O(C × A)
parameters.AllowedInputs.Any(y => y.Hash == x.TransactionId && y.N == x.Index)

// After — O(C)
var allowedInputSet = parameters.AllowedInputs.Select(x => x.Outpoint).ToHashSet();
allowedInputSet.Contains(x.Outpoint)

Patch

Fix available: defects/wasabi-0002/patch/wasabi-0002.patch

Single-file patch in WalletWasabi/Blockchain/Transactions/TransactionFactory.cs.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (WalletWasabi/WalletWasabi).
Assess severity — fires per transaction construction.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Wasabi team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.1 KiB Raw Blame History Unescape Escape