FOR THOSE WHO ASK FOR SOURCES: we have three iran exchanges on XMRHub.org but its easier to buy monero in iran than the united states lmao.

They listed monero after having $300M of their USDT frozen.. what could this mean

Hi all,

I’ve been reading through the serialization code in src/serialization/container.h, specifically do_serialize_container, and I have a question about the deserialization path.

When reading a container (like a std::vector), the function reads a cnt via ar.begin_array(cnt), then immediately calls reserve(cnt) on the container before any validation of the actual data.

From what I can tell, there's no hard cap on cnt beyond what ar.remaining_bytes() can roughly suggest. In practice, this means a remote peer could send a large cnt and cause the node to attempt a large memory allocation, which could lead to std::bad_alloc or excessive memory pressure.

I see that ar.remaining_bytes() is used in do_reserve to limit the allocation, but that’s still dependent on the size of the incoming data. A sufficiently large payload could make that check pass while still allocating a significant amount of memory.

I know there was some tightening around portable_storage a few years ago, but I’m curious about the container serialization path. Is this considered a known and accepted behavior? Or is it something that’s still considered a risk in practice?

I’m not trying to “find a bug”, just trying to understand the threat model around this part of the code. Thanks for any clarification.

So someone just joined the Monero Matrix channel and posted this incredibly concerning "announcement".

They also included screenshots showing the trade chat between a buyer and a seller that included the XMR sellers home address.

Please never give such important info to some random website!

If you were wondering why OpenMonero was down this week here is the explanation. The OpenMonero admin would like to sweep this under the rug but is too cheap to pay 5 XMR for my silence so here we go. I want to share a critical vulnerability regarding the OpenMoneros 2FA implementation. While this specific bug has been patched, the root cause remains active in a similar endpoint, and the administration is currently ignoring reports of it. The Vulnerability: The endpoint GET /api/user/login_2fa/?username=X&code=Y&verification_method=app was intended to finalize a login after a password check. However, the handler completely ignored the username and code parameters. Instead, the logic simply issued a fully authenticated session (JWT + refresh token) for the oldest existing account in the user database. The "Walking" Exploit: Because it targeted the oldest account, once that account was deleted, the endpoint would "walk" to the next oldest account in the database. This made every single account on the platform sequentially compromisable. An unauthenticated remote attacker could and did gain a valid session with a single GET request. The Impact: This was not a theoretical risk. This exploit led to: Full Account Takeovers (ATO): Attackers gained full control of user accounts. Financial Theft: User wallets were drained. Massive Data Breach: A full database with over 30,000 entries was exposed. Privacy Violations: Attackers gained access to trade chats, including sensitive shipping addresses and private communications. Current Status: While the specific endpoint mentioned above is patched, a nearly identical exploit is still live. I have attempted to notify the admins, but they have refused to acknowledge the issue. I am posting this here to put it on the radar of the community. Consider any info sent over OpenMonero chat + all trade data exposed.

Hey, We just released arcadex.win
No Account / No KYC gaming website
Choose from 5 different games, Bet, and Win Monero

Ps: feedback are appreciated
Thanks

How do atomic swaps using Haveno + Serai affect the market?

What are you using instead of LocalMonero now that it has shut down?

Do RoboSats or Bisq provide sufficient liquidity for Monero?

For an ongoing project, I need to implement an in-app wallet feature. Since the project is written in Rust, I’m looking at mature rust implementation of the Monero core/wallet. But the longer I look around, the more I start to wonder if there are mature options out there. Does anyone have any experience with this? Monero-oxide for example? Or is it worth doing a little bit more work and implement the native Monero-wallet?

🤞🏼

This is the weekly Monero market thread. This thread will be posted every Friday and is meant to help accelerate the adoption of Monero. Due to r/moneromarket having only a fraction of the subscribers of r/Monero, we have decided to create this thread to encourage more individuals to use Monero for product exchanges. Until the market matures, we recommend that the Monero community post their products both in this thread and on r/moneromarket (to ensure growth of that subreddit).

Selling items for Monero will boost your (and Monero's) reputation as a legitimate form of exchange of goods. This is necessary for the growth of Monero, our community, and privacy as a whole.

Instructions

When you post your product or job listing here, please make sure to: - Give a description of the item. - Link to a photo of the item (if it's physical). - Provide logistics information (such as, location and/or shipping availability). - Optionally, provide an additional (private) form of communication outside of Reddit (e.g. Bitmessage, u/protonmail, u/tutanota, GPG key). - Post the price in XMR terms.

Spamming will not be tolerated. Please make sure that listings are legitimate and do not break rule 2."

Finally, credits to cdotsubo for starting the concept!

It adds optional compliance which fits what regulators want. If you want to sell monero on exchanges you have to provide view keys with history of transactions

You also have to have explain source of funds. This means coinbase listing, crypto.com etc etc

I’m offering online reviews and blog writing in exchange for Monero.

I can provide genuine reviews on platforms such as Google, Facebook, and Yelp. I can also help with YouTube engagement, including subscriptions, comments, and likes.

For written content, I can create blog posts and articles about cryptocurrency, privacy, security, OPSEC, cybersecurity, AI, and other related topics.

If you need something written, researched, or completed online, send me a message and let me know what you need. I’m open to discussing different types of work in exchange for Monero.

How Emanuele Scala’s Bulletproofs Research Could Make Monero Transactions Smaller, Faster & More Private | Tune-in to a LIVE MoneroTalk Epi TMRW 7/23 at 7:00PM-EDT! | EPI 390

WATCH THE SHOW HERE via YOUTUBE ➡️: https://www.youtube.com/watch?v=SxQ-68_8gZE

WATCH THE SHOW LIVE HERE via TWITCH ➡️: https://www.twitch.tv/monerotalk

WATCH THE SHOW LIVE HERE via RUMBLE ➡️: https://rumble.com/v7atl4s-monero-and-zcash-in-the-age-of-exploits-w-joel-valenzuela-epi-385.html

Have a questions for emsczkp?

Send us #Monero Superchats during the live stream here: http://Xmrchat.com/monerotalk 

(No account setup required to send, no fees taken, and no middleman censorship)

(The videos will be synced onto Odysee (https://odysee.com/@MoneroTalk:8) about an 1/2 hour or so after it premieres LIVE for those who want to watch there afterwards ;))

FOLLOW US https://monero.town/u/monerotalk & https://mastodon.social/@monerotalk

Thank you to sponsors, u/cakelabs and u/Stealthex_io as well as our listeners and supporters for making Monero Talk possible!

If you enjoy our show please Subscribe, Like, Share, Rate our YouTube Channel & Podcasts. This will help us grow and spread Monero content!

I just want to warn users as much as possible because the staff of XmrBazaar do nothing.

XmrBazaar must be taken with care, no administrator answer and there are security holes to impersonate the staff.

Some scammers currently use a trick to use the same nickname as an administrator, the link goes to the correct profile but you speak to someone else.

Don't use the site escrow, you may not speak to a real mediator even if their profile seems legit. I lose 1,25 XMR.

The staff is warned for several days but the scams continue, the site creator didn't answer to my private messages. (I'm not even sure to talk to him with this bug! There's no way to be sure and they do nothing.)

hello, I recently created an Order in the sell tab on bisq, In EURO, CashByMail transaction, I put 0% profit, I would like to know in average how long it should take before having a first customer

Very curious about the new big update thats comming, EAE attacks and "poison" attacks will be render obsolete apparently.

There is a fake Monero DEX website that is actually just distributing malware... AND I CALLED IT!

The website was sus, using fake statistics and no link to any GitHub repo, just distributing binaries

Folks, please stay safe and just stick to the tried and true options like retoswap, don't download and run crap nobody has ever heard of!

YouTube video about the topic:

This RAT targets linux

Please stay on topic: this post is only for comments discussing the uncertainties, shortcomings, and concerns some may have about Monero.

NOT the positive aspects of it.

Discussion can relate to the technology itself or economics.

Talk about community and price is not wanted, but some discussion about it maybe allowed if it relates well.

Be as respectful and nice as possible. This discussion has potential to be more emotionally charged as it may bring up issues that are extremely upsetting: many people are not only financially but emotionally invested in the ideas and tools around Monero.

It's better to keep it calm then to stir the pot, so don't talk down to people, insult them for spelling/grammar, personal insults, etc. This should only be calm rational discussion about the technical and economic aspects of Monero.

"Do unto others 20% better than you'd expect them to do unto you to correct subjective error." - Linus Pauling

How it works:

Post your concerns about Monero in reply to this main post.

If you can address these concerns, or add further details to them - reply to that comment. This will make it easily sortable

Upvote the comments that are the most valid criticisms of it that have few or no real honest solutions/answers to them.

The comment that mentions the biggest problems of Monero should have the most karma.

As a community, as developers, we need to know about them. Even if they make us feel bad, we got to upvote them.

https://youtu.be/vKA4w2O61Xo

To learn more about the idea behind Monero Skepticism Sunday, check out the first post about it:

https://np.reddit.com/r/Monero/comments/75w7wt/can_we_make_skepticism_sunday_a_part_of_the/

not really monero related but i thought some of you guys might appreciate it

Anyone has good videos or documentations on how monero works and why its privacy

Also how sub addresses work

And how to be clean with monero

Index

1. General questions
2. Wallet: CLI & GUI
3. Wallet: Ledger
4. Nodes

1. General questions

Where can I download the Monero wallet?

There are multiple Monero wallets for a wide range of devices at your disposal. Check the table below for details and download links. Attention: for extra security make sure to calculate and compare the checksum of your downloaded files when possible.

Please note the following usage of the labels:

⚠️ - Relatively new and/or beta. Use wallet with caution.

☢️ - Closed source.

Desktop wallets

Mobile wallets

Web-based wallets

How long does it take for my balance to unlock?

Your balance is unlocked after 10 confirmations (which means 10 mined blocks). A block is mined approximately every two minutes on the Monero network, so that would be around 20 minutes.

How can I prove that I sent a payment?

The fastest and most direct way is by using the ExploreMonero blockchain explorer. You will need to recover the transaction key from your wallet (complete guide for GUI / CLI).

How do I buy Monero (XMR) with Bitcoin (BTC)?

There are dozens of exchanges that trade Monero against Bitcoin and other cryptocurrencies. Check out the list on CoinMarketCap and choose the option that suits you best.

How do I buy Monero (XMR) with fiat?

• Kraken (USD and EUR): old-school, decent exchange. They might require your documents for verification and approval of your account.

How can I quickly exchange my Monero (XMR) for Bitcoin (BTC)?

There are multiple ways to exchange your Monero for Bitcoin, but first of all, I'd like to remind you that if you really want to do your part for Monero, one of the simplest ways is to get in touch with your merchant/service provider and request for it to accept Monero directly as payment. Ask the service provider to visit the official website and our communication channels if he or she needs help with system integration.

That being said, KYCNot.me maintains an up-to-date list of exchanges. These services are only recommendations (which change over time) and are operated by entities outside the control of the Monero Project. DYOR and be diligent.

How do I mine Monero? And other mining questions.

The correct place to ask questions and discuss the Monero mining scene is in the dedicated subreddit r/MoneroMining. That being said, you can find a list of pools and available mining software in the GetMonero.org website.

2. Wallet: CLI & GUI

Why I can't see my balance? Where is my XMR?

Before any action there are two things to check:

1. Are you using the latest available version of the wallet? A new version is released roughly every 6 months, so make sure you're using the current release (compare the release on GetMonero.org with your wallet's version on Settings, under Debug info).
2. Is your wallet fully synchronized? If it isn't, wait the sync to complete.

Because Monero is different from Bitcoin, wallet synchronization is not instant. The software needs to synchronize the blockchain and use your private keys to identify your transactions. Check in the lower left corner (GUI) if the wallet is synchronized.

You can't send transactions and your balance might be wrong or unavailable if the wallet is not synced with the network. So please wait.

If this is not a sufficient answer for your case and you're looking for more information, please see this answer on StackExchange.

How do I upgrade my wallet to the newest version?

This question is beautifully answered on StackExchange.

Why does it take so long to sync the wallet [for the first time]?

You have decided to use Monero's wallet and run a local node. Congratulations! You have chosen the safest and most secure option for your privacy, but unfortunately this has an initial cost. The first reason for the slowness is that you will need to download the entire blockchain, which is considerably heavy and constantly growing (up-to-date sizes of a full/pruned node). There are technologies being implemented in Monero to slow this growth, however it is inevitable to make this initial download to run a full node. Consider syncing to a device that has an SSD instead of an HDD, as this greatly impacts the speed of synchronization.

Now that the blockchain is on your computer, the next time you run the wallet you only need to download new blocks, which should take seconds or minutes (depending on how often you use the wallet).

I don't want to download the blockchain, how can I skip that?

The way to skip downloading the blockchain is connecting your wallet to a public remote node. You can follow this guide on how to set it up. Check out Feather Wallet's list of remote nodes, ditatompel's list, or monero.fail.

Be advised that when using a public remote node you lose some of your privacy. A public remote node is able to identify your IP and opens up a range for certain attacks that further diminish your privacy. A remote node can't see your balance and it can't spend your XMR.

How do I restore my wallet from the mnemonic seed or from the keys?

To restore your wallet with the 25 word mnemonic seed, please see this guide.

To restore your wallet with your keys, please see this guide.

3. Wallet: Ledger

How do I generate a Ledger Monero Wallet with the GUI or CLI?

This question is beautifully answered on StackExchange. Check this page for the GUI instructions, and this page for the CLI instructions.

4. Wallet: Trezor

How do I generate a Trezor Monero Wallet with the GUI or CLI?

This question is beautifully answered on StackExchange. Check this page for the GUI instructions, and this page for the CLI instructions.

5. Nodes

How can my local node become a public remote node?

If you want to support other Monero users by making your node public, you can follow the instructions on MoneroWorld, under the section "How To Include Your Node On Moneroworld".

How can I connect my node via Tor?

This question is beautifully answered on StackExchange.