GLEECBTC/komodo-daemon v0.9.2-3

Komodo 0.9.2-3

on GitHub

This release fixes CLTV script parsing and related transaction output classification.

This security update is mandatory for exchanges, block explorer operators, Electrum server operators, and other services relying on komodod for transaction indexing, wallet balances or deposit processing.

Upgrade all affected komodod instances to 0.9.2-3 promptly. Services that embed or maintain a fork of the affected code should incorporate the corresponding fixes.

All other node and wallet users are strongly encouraged to upgrade.

What's Changed

• Correctly validate CLTV prefixes, including the locktime value and the following OP_CHECKLOCKTIMEVERIFY and OP_DROP instructions.
• Prevent malformed scripts from being incorrectly classified as P2PKH outputs or recognized as belonging to the wallet.
• Remove unchecked byte indexing from CLTV prefix recognition and correctly handle signed script numbers.

Checksum & VirusTotal Analysis:

This release was signed by https://keybase.io/deckersu (GPG fingerprint: FD9A 772C 7300 F4C8 94D1 A819 FE50 4808 62E6 451C).