diff options
| author | Wladimir J. van der Laan <[email protected]> | 2014-09-22 09:03:36 +0200 |
|---|---|---|
| committer | Wladimir J. van der Laan <[email protected]> | 2014-09-22 09:03:59 +0200 |
| commit | 5547f08ec70882340fc0cf76e2a442298c02f326 (patch) | |
| tree | 6844326ce33fb9f45db477c45e693cc4910258df /src/core.cpp | |
| parent | Merge pull request #4950 (diff) | |
| parent | Add warning about the merkle-tree algorithm duplicate txid flaw (diff) | |
| download | discoin-5547f08ec70882340fc0cf76e2a442298c02f326.tar.xz discoin-5547f08ec70882340fc0cf76e2a442298c02f326.zip | |
Merge pull request #4952
01c2807 Add warning about the merkle-tree algorithm duplicate txid flaw (Peter Todd)
Diffstat (limited to 'src/core.cpp')
| -rw-r--r-- | src/core.cpp | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/core.cpp b/src/core.cpp index 491e4fa68..e52327ba8 100644 --- a/src/core.cpp +++ b/src/core.cpp @@ -226,6 +226,13 @@ uint256 CBlockHeader::GetHash() const uint256 CBlock::BuildMerkleTree() const { + // WARNING! If you're reading this because you're learning about crypto + // and/or designing a new system that will use merkle trees, keep in mind + // that the following merkle tree algorithm has a serious flaw related to + // duplicate txids, resulting in a vulnerability. (CVE-2012-2459) Bitcoin + // has since worked around the flaw, but for new applications you should + // use something different; don't just copy-and-paste this code without + // understanding the problem first. vMerkleTree.clear(); BOOST_FOREACH(const CTransaction& tx, vtx) vMerkleTree.push_back(tx.GetHash()); |