sp: mitigate worst-case scanning attack by removing found outputs from list

theStack · theStack · commit 135ca0a194f8 · 2025-11-25T18:27:42.000+01:00
idea based on jonasnick's idea of tracking already found outputs in scanning [1], but without the need of dynamic memory allocation [1] jonasnick@311b4eb
diff --git a/examples/silentpayments.c b/examples/silentpayments.c
@@ -365,7 +365,7 @@ int main(void) {
             start = clock();
             ret = secp256k1_silentpayments_recipient_scan_outputs(ctx,
                 found_output_ptrs, &n_found_outputs,
-                (const secp256k1_xonly_pubkey * const *)tx_output_ptrs, N_OUTPUTS,
+                (const secp256k1_xonly_pubkey**)tx_output_ptrs, N_OUTPUTS,
                 bob_scan_key,
                 &prevouts_summary,
                 &unlabeled_spend_pubkey,
@@ -446,7 +446,7 @@ int main(void) {
             n_found_outputs = 0;
             ret = secp256k1_silentpayments_recipient_scan_outputs(ctx,
                 found_output_ptrs, &n_found_outputs,
-                (const secp256k1_xonly_pubkey * const *)tx_output_ptrs, 1, /* dummy scan with one output (we only care about Bob) */
+                (const secp256k1_xonly_pubkey**)tx_output_ptrs, 1, /* dummy scan with one output (we only care about Bob) */
                 carol_scan_key,
                 &prevouts_summary,
                 &unlabeled_spend_pubkey,
diff --git a/include/secp256k1_silentpayments.h b/include/secp256k1_silentpayments.h
@@ -324,7 +324,7 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_silentpayments_recipien
     const secp256k1_context *ctx,
     secp256k1_silentpayments_found_output **found_outputs,
     size_t *n_found_outputs,
-    const secp256k1_xonly_pubkey * const *tx_outputs,
+    const secp256k1_xonly_pubkey **tx_outputs,
     size_t n_tx_outputs,
     const unsigned char *scan_key32,
     const secp256k1_silentpayments_prevouts_summary *prevouts_summary,
diff --git a/src/modules/silentpayments/main_impl.h b/src/modules/silentpayments/main_impl.h
@@ -500,7 +500,7 @@ int secp256k1_silentpayments_recipient_prevouts_summary_create(
 int secp256k1_silentpayments_recipient_scan_outputs(
     const secp256k1_context *ctx,
     secp256k1_silentpayments_found_output **found_outputs, size_t *n_found_outputs,
-    const secp256k1_xonly_pubkey * const *tx_outputs, size_t n_tx_outputs,
+    const secp256k1_xonly_pubkey **tx_outputs, size_t n_tx_outputs,
     const unsigned char *scan_key32,
     const secp256k1_silentpayments_prevouts_summary *prevouts_summary,
     const secp256k1_pubkey *spend_pubkey,
@@ -512,7 +512,7 @@ int secp256k1_silentpayments_recipient_scan_outputs(
     secp256k1_xonly_pubkey output_xonly;
     unsigned char shared_secret[33];
     const unsigned char *label_tweak = NULL;
-    size_t j, found_idx;
+    size_t j, found_idx, n_remaining_tx_outputs;
     uint32_t k;
     int found, combined, valid_scan_key, ret;
 
@@ -553,6 +553,7 @@ int secp256k1_silentpayments_recipient_scan_outputs(
     secp256k1_scalar_clear(&scan_key_scalar);
 
     found_idx = 0;
+    n_remaining_tx_outputs = n_tx_outputs;
     for (k = 0; k < n_tx_outputs; k++) {
         secp256k1_ge output_ge = spend_pubkey_ge;
         /* Calculate the output_tweak and convert it to a scalar.
@@ -577,7 +578,7 @@ int secp256k1_silentpayments_recipient_scan_outputs(
         }
         found = 0;
         secp256k1_xonly_pubkey_save(&output_xonly, &output_ge);
-        for (j = 0; j < n_tx_outputs; j++) {
+        for (j = 0; j < n_remaining_tx_outputs; j++) {
             if (secp256k1_xonly_pubkey_cmp(ctx, &output_xonly, tx_outputs[j]) == 0) {
                 label_tweak = NULL;
                 found = 1;
@@ -665,6 +666,11 @@ int secp256k1_silentpayments_recipient_scan_outputs(
                 /* Set the label public key with an invalid public key value. */
                 memset(&found_outputs[k]->label, 0, sizeof(secp256k1_pubkey));
             }
+            /* Remove found entry from list of outputs to scan (shift remaining entries to the left) */
+            for (j = found_idx + 1; j < n_remaining_tx_outputs; j++) {
+                tx_outputs[j-1] = tx_outputs[j];
+            }
+            n_remaining_tx_outputs--;
             /* Reset everything for the next round of scanning. */
             label_tweak = NULL;
             /* BIP0352 specifies that k is serialized as a 4 byte (32 bit) value, so we check to make
