Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Secrets must be high entropy. There are two sensitive secrets for wallets in this case: master secret, and master nullifier. When converting the key to a value usable by the Privacy Pools SDK, it was converted from 32 bytes to a floating-point number in JavaScript via bytesToNumber().

Because JavaScript floats are imprecise, the values were rounded instead of being exact. This reduced the entropy from 256 bits to 53 bits of security. One is impossible to brute-force, while the second one is doable on modern hardware.

The reduced entropy leads to deanonymization to link deposits and withdrawals. Worse, though, an attacker could brute-force the master secret and master nullifier, thereby becoming the user entirely and stealing their funds. For wallet generation software, this is the worst-case scenario.

They introduced a migration flow to handle this issue. Notably, it generates stronger keys, and moves existing notes to new nodes. What's weird to me is that the mnemonic is safe, but its use wasn't. So, the backup doesn't change.

The fix is to move to bytesToBigInt(), which supports arbitrarily large integers. Overall, a good post on a security issue and how the team mitigated it.