monero-ecosystem/monero-python

Hex seed overflow on Seed(hex)

Monero-HackerIndustrial opened this issue · 0 comments

Seed() expects either a string mnemonic or a hex seed. The default hex seed length that the library produces is 32 bytes.
If I feed a 128 byte hex seed to Seed() I get a seed phrase of 96 letters.
This is a simple interactive python shell showing an example. The output has been commented out.

thirtytwo = "".join(hexlify(urandom(32)).decode("utf-8"))
onetwentyeight = "".join(hexlify(urandom(128)).decode("utf-8"))

Seed(thirtytwo).phrase
#'dotted afoot yellow lofty hiker baffles click ivory dunes shackles axis nozzle fibula anchor illness gables lobster nirvana dapper sake theatrics bicycle pledge corrode lofty'

Seed(onetwentyeight).phrase
#'ugly down beyond atrium nineteen firm atrium feast stacking vials sniff tequila toilet gags smidgen exhale absorb opacity update biology afraid rogue cabin paper pyramid suffice hemlock thorn eels boyfriend gutter happens nuisance haggled nomad public abducts pavements paradise lexicon locker pride cylinder library dreams warped reef awoken roles nineteen bunch cunning legion unafraid obtains village dagger ouch unafraid roared smog ultimate goldfish technical setup orbit lower zigzags hedgehog lion vexed lynx bailed napkin alerts amnesty voyage gesture zippers heels asked malady poaching urgent pioneer bagpipe beyond orange bested mural umpire ensign software ahead paddles byline smidgen'

monero.__version__
#'1.0.2'

len(Seed(onetwentyeight).phrase.split())
#97 
len(Seed(thirtytwo).phrase.split())
#32 

errorInPython

Shouldn't Seed() check that there is no overflow? Overflow seeds are fed directly into the "encode_seed" function. This leads to non standard mnemonic words and could lead to loss of funds.