From 260bc341f141f9e5a8c729d318ecaa0a34d66ad4 Mon Sep 17 00:00:00 2001 From: gantea Date: Thu, 10 Sep 2026 20:23:25 -0400 Subject: [PATCH] Fix sweep nonce non-determinism and TLS hostname verification disabled In electrumsv/gui/qt/sweep_helper.py: - Sign sweep transactions with RFC6979 deterministic nonce (sign_digest_deterministic) instead of the non-deterministic ecdsa.sign_digest which falls back to os.urandom. Prevents potential private key recovery via nonce reuse. - Stop setting check_hostname=False on the ElectrumX socket TLS context, restoring hostname verification (fails secure). --- electrumsv/gui/qt/sweep_helper.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/electrumsv/gui/qt/sweep_helper.py b/electrumsv/gui/qt/sweep_helper.py index cbef761..9e3f0e8 100644 --- a/electrumsv/gui/qt/sweep_helper.py +++ b/electrumsv/gui/qt/sweep_helper.py @@ -132,7 +132,6 @@ def create_ssl_context(host: str) -> ssl.SSLContext: if os.path.exists(pem_path): try: ctx.load_verify_locations(cafile=pem_path) - ctx.check_hostname = False except Exception as e: logger.warning("Failed to load host PEM %s: %s", pem_path, e) return ctx @@ -307,7 +306,8 @@ def sweep_single_privkey( script_pubkey_bytes, value_sats = prevouts[i] sighash = tx.signature_hash(i, value_sats, script_pubkey_bytes, sighash=SigHash(SigHash.ALL | SigHash.FORKID)) - der_sig = sk.sign_digest(sighash, sigencode=ecdsa.util.sigencode_der_canonize) + der_sig = sk.sign_digest_deterministic( + sighash, hashfunc=hashlib.sha256, sigencode=ecdsa.util.sigencode_der_canonize) signature = der_sig + b"\x41" # SigHash.ALL|FORKID txin.script_sig = Script(bytes([len(signature)]) + signature + bytes([len(pubkey_bytes)]) + pubkey_bytes)