$ cat zano-unauthenticated-mempool-purge.md
writeup2026-04-10·7 min
An admin RPC with no auth, and three more findings on Zano
#c++#rpc#privacy#immunefi
##reset_transaction_pool, unguarded
Zano is a CryptoNote/Zarcanum-lineage privacy L1. Its admin RPC exposes reset_transaction_pool, whose handler calls purge_transactions() with no token, header, or caller check.
Against an admin-API node bound to a reachable interface, any remote party can clear the entire mempool with a single unauthenticated POST — and repeat it to suppress transactions and stall confirmations indefinitely.
##And a DoS in the accept path
tx_memory_pool::add_tx admits a transaction with no early upper bound on size, input/output count, or Zarcanum proof complexity — it verifies *after* accepting. One crafted 200+ input/output transaction spikes node CPU past 30%; repeated submissions amplify it.
##Two wallet lows worth their own writeup
- ▸No TLS verification on the
httpswallet↔daemon path — SSL is enabled but no CA/hostname/expiry check, so an on-path attacker can transparently MITM all RPC. - ▸JWT anti-replay salts aren't persisted — consumed salts live only in memory, so after a wallet-RPC restart a still-unexpired token + body can be replayed to re-run
transfer/sweep_below.