Issues

• minotari_mcp_wallet: password passed via argv, --require-confirmation not enforced, no gRPC auth support

  tari-project/tari#8078 · Filter by author SWvheerden opened on Oct 5, 2026

• coin_split_even burns the entire selected balance to miner fees when fee >= input sum

  tari-project/tari#8073 · Filter by author cyber841 opened on Oct 2, 2026

• Console wallet gRPC mode does not shut down on SIGTERM or SIGINT

  tari-project/tari#8063 · Filter by author pithead-developer opened on Sep 29, 2026

• Tracking: minotari_app_utilities security hardening

  tari-project/tari#8043 · Filter by author SWvheerden opened on Sep 18, 2026

• Miner and merge mining proxy mine whatever block a p2pool node returns without checking that the coinbase pays wallet_payment_address

  tari-project/tari#8042 · Filter by author SWvheerden opened on Sep 18, 2026

• minotari_app_utilities hardening batch: four small defects from the security analysis

  tari-project/tari#8041 · Filter by author SWvheerden opened on Sep 18, 2026

• Docker rig and Linux runtime scripts: no umask, unchecked mkdir on a root-owned bind mount, README mounts at the home level, and a nonexistent --create_id flag

  tari-project/tari#8040 · Filter by author SWvheerden opened on Sep 18, 2026

• Effective base, config and identity paths are never logged, and an unset HOME silently uses the working directory

  tari-project/tari#8039 · Filter by author SWvheerden opened on Sep 18, 2026

• CommonCliArgs discards the resolved network when computing common.base_path

  tari-project/tari#8038 · Filter by author SWvheerden opened on Sep 18, 2026

• -p key=value overrides are truncated at the first = and trimmed, and are logged unmasked at trace level

  tari-project/tari#8037 · Filter by author SWvheerden opened on Sep 18, 2026

• Miner and proxy prompts spin at 100% CPU on a non-TTY stdin, panic on closed input, and exit 0 from library code

  tari-project/tari#8036 · Filter by author SWvheerden opened on Sep 18, 2026

• Starting once on TCP transport permanently strips onion addresses from the identity file, and configured addresses are add-only

  tari-project/tari#8035 · Filter by author SWvheerden opened on Sep 18, 2026

• Tor identity is loaded through load_from_json with no permission check; load_tor_identity has no callers

  tari-project/tari#8034 · Filter by author SWvheerden opened on Sep 18, 2026

• Identity file checks are advisory: symlinks are followed, ownership is never checked, the config directory is created 0755, and Windows enforces nothing

  tari-project/tari#8033 · Filter by author SWvheerden opened on Sep 18, 2026

• A malformed identity file echoes its secret key into the warn log, stderr and the exit error

  tari-project/tari#8032 · Filter by author SWvheerden opened on Sep 18, 2026

• load_node_identity rewrites the secret-key file on every start with a non-atomic truncate-then-write, and minotari_peer_sync can write it concurrently

  tari-project/tari#8031 · Filter by author SWvheerden opened on Sep 18, 2026

• Node identity is silently regenerated over an existing file on any load failure, and the interactive prompt treats empty input as yes

  tari-project/tari#8030 · Filter by author SWvheerden opened on Sep 18, 2026

• Tracking: minotari_app_grpc security hardening

  tari-project/tari#8025 · Filter by author SWvheerden opened on Sep 16, 2026
  1

• mining_enabled and second_layer_grpc_enabled silently enable gRPC methods regardless of grpc_server_allow_methods

  tari-project/tari#8024 · Filter by author SWvheerden opened on Sep 16, 2026

• build_features() silently defaults to TestNet when TARI_TARGET_NETWORK is unset, and the resulting cfg gates consensus-relevant code

  tari-project/tari#8023 · Filter by author SWvheerden opened on Sep 16, 2026
  1

• Dependency hygiene for the gRPC stack: yanked chacha20, argon2 release candidate, stale rcgen, mutable git tag for liblmdb-sys, and no cargo deny policy

  tari-project/tari#8022 · Filter by author SWvheerden opened on Sep 16, 2026
  1

• minotari_app_grpc hardening batch: seven small defects from the security analysis

  tari-project/tari#8021 · Filter by author SWvheerden opened on Sep 16, 2026

• ImportUtxos carries raw spending keys in proto fields; they are zeroized only on the success path and printed by the derived Debug

  tari-project/tari#8020 · Filter by author SWvheerden opened on Sep 16, 2026

• gRPC conversions enforce no size bounds beyond the 8 MiB message cap: quorum certificate signatures, range proof bytes and block body element counts are unbounded at the boundary

  tari-project/tari#8019 · Filter by author SWvheerden opened on Sep 16, 2026

• create-tls-certs writes the server private key world-readable, generates non-expiring certificates from an unconstrained CA whose key is discarded, and panics instead of returning errors

  tari-project/tari#8018 · Filter by author SWvheerden opened on Sep 16, 2026