Monero: `check_reserve_proof` counts duplicate entries: one output can inflate `total`

A vulnerability was discovered in the checkreserveproof function in the Monero wallet software. The vulnerability allowed duplicate entries in the reserve proof, which could artificially inflate the reported total reserve amount without affecting the verification of individual entries. The issue...

Monero: `check_reserve_proof` sums RingCT ECDH amounts without checking the output commitment

The checkreserveproof function in the Monero codebase was found to sum RingCT ECDH amounts without checking the output commitment. The decoded amount was added to the total without verifying that it matched the commitment, which could allow a malicious prover to claim larger reserves than actuall...