Skip to content
This repository has been archived by the owner on Mar 9, 2024. It is now read-only.
This repository has been archived by the owner on Mar 9, 2024. It is now read-only.

Hex seed overflow on Seed(hex) #129

Open
@Monero-HackerIndustrial

Description

Seed() expects either a string mnemonic or a hex seed. The default hex seed length that the library produces is 32 bytes.
If I feed a 128 byte hex seed to Seed() I get a seed phrase of 96 letters.
This is a simple interactive python shell showing an example. The output has been commented out.

thirtytwo = "".join(hexlify(urandom(32)).decode("utf-8"))
onetwentyeight = "".join(hexlify(urandom(128)).decode("utf-8"))

Seed(thirtytwo).phrase
#'dotted afoot yellow lofty hiker baffles click ivory dunes shackles axis nozzle fibula anchor illness gables lobster nirvana dapper sake theatrics bicycle pledge corrode lofty'

Seed(onetwentyeight).phrase
#'ugly down beyond atrium nineteen firm atrium feast stacking vials sniff tequila toilet gags smidgen exhale absorb opacity update biology afraid rogue cabin paper pyramid suffice hemlock thorn eels boyfriend gutter happens nuisance haggled nomad public abducts pavements paradise lexicon locker pride cylinder library dreams warped reef awoken roles nineteen bunch cunning legion unafraid obtains village dagger ouch unafraid roared smog ultimate goldfish technical setup orbit lower zigzags hedgehog lion vexed lynx bailed napkin alerts amnesty voyage gesture zippers heels asked malady poaching urgent pioneer bagpipe beyond orange bested mural umpire ensign software ahead paddles byline smidgen'

monero.__version__
#'1.0.2'

len(Seed(onetwentyeight).phrase.split())
#97 
len(Seed(thirtytwo).phrase.split())
#32 

errorInPython

Shouldn't Seed() check that there is no overflow? Overflow seeds are fed directly into the "encode_seed" function. This leads to non standard mnemonic words and could lead to loss of funds.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions