Loss of multisig funds through single malicious participant's deliberate deception

How it was found

Summary:

A single malicious participant of a multisig can trick other users into sending funds multiple times to a certain recipient. This cannot be distinguished from a legitimate user easily.

https://docs.getmonero.org/multisignature/#spending

Keep in mind that partially signed multisig transactions can fail to be signed by the next participants with the following error, see the docs. Error: Multisig error: This signature was made with stale data: export fresh multisig data, which other participants must then use

Suppose that a group of participants in a multisig is trying to send funds to address X. They have two inputs A and B. They create a transaction with input A, paying X. They sign and sign, but the last signer is malicious. He signs and saves the transaction without broadcasting, but claims it fails. "Guys, we need to do it again." Then he creates a transaction with input B, paying X. The others sign and release that transaction B -> X. Then the malicious signer releases A -> X. Double payment. (The malicious participant is especially incentivized to do this if he controls X.)

This could be somewhat mitigated by allowing users to see the input in a tx, so that the other users won't sign B -> X, as they have already "locked in" A -> X by deliberate action external to the Monero software (whether by memorization as humans or programmatically). This is currently not enabled by any RPC or wallet command, so this is impossible to detect for a normal user.

If this is implemented, it still does not fix the problem, because there is no way to build a transaction while deliberately selecting inputs. If a legitimate user actually did fail the signing because of the stale data error, but during that time the multisig received new coins, the transfer algorithm might select different inputs, and the user would appear malicious. There is no way to use the same input as the first time, because the transfer command or any other RPC or wallet command doesn't let you select inputs. This does not stop the attacker of course, who can deliberately send coins to the multisig to affect how the transfer construction algorithm selects inputs, until it selects a different set of inputs.

As a disclaimer, I asked about this in the monero research lounge chat because I thought it was a solved problem. It turned out there is no way to address this yet.

If you are wondering, this issue does not exist in bitcoin, because in bitcoin, 1. you can see the inputs, 2. you can select the inputs, 3. signatures don't expire so "made with stale data" doesn't work as an excuse. None of these are currently the case with monero.

AI was not used in this report, for any step.

Releases Affected:

All

Steps To Reproduce:

1. Using the CLI, create a multisig wallet. Use a local testing network.
2. Try building a multisig transaction. Verify that even when no blocks are being produced, after waiting a few minutes, the error Error: Multisig error: This signature was made with stale data: export fresh multisig data, which other participants must then use occurs when trying to sign as stated in the docs.
3. Build a transaction.
4. Sign with all multisig participants, but the last one keeps it and doesn't broadcast.
5. Send a bunch of other outputs to the multisig wallet until you can use transfer to build a transaction with a different input than the previous one (it's not clear what criteria are needed). It should be able to be seen with https://github.com/monero-project/monero/pull/10281.
6. Sign and broadcast that one.
7. Broadcast the first one.

Supporting Material/References:

Seeing inputs branch by jeffro256 was made after some discussion: https://github.com/monero-project/monero/pull/10281

Housekeeping

I read https://github.com/monero-project/meta/blob/master/VULNERABILITY_RESPONSE_PROCESS.md

The link to available xmr for bounties does not work.

My address

88AHxEzRjyq1Jd4BMah9jVGi8jUdtd9DRK5KtFFYQjA5HSCg9T8zJG1CJZLKrN1xytYSPy5jq7XtXRnVrxTdHHUS5hJpK2D

Impact

Loss of funds from the multisig due to multiple sends induced by the malicious participant when only one was intended.