What type of security audits has Monero received?

Since this question already addressed cryptographic review of the Monero protocol, I am primarily interested in Monero source code and implementation audits. If audits have taken place have results been published in a manner similar to this?

2 Answers 2


As well as the informal review of CryptoNote provided to the Monero team by SURAE NOETHER here, the source code is available on monero-project's github here.

These slides also review the protocol. A possibly important note from those slides about the spec that isn't found anywhere else is given after slide 28, saying:

apparently 2 bad random r in monero same user, make the attacker who has 2 view keys v also, able to compute a linear relation between their e keys used to spend... nc, 07/10/2016

Edit: I think I know the relation nicolas is referring to -- if we simplify the stealth formula to A + H(S_1)G, A + H(S_2)G, so the private keys are a + H(S_1) and a + H(S_2), the linear relation between the spend keys is equal to the linear relation between the public keys. something not mentioned is that this also would mean the master spend key can be computed from any leaked spendkey. So don't share your spendkeys, even after use!

Also this paper deanonymising rings with small size: monerolink, and this one tooo: A Traceability Analysis of Monero’s Blockchain. Community response to the monerolink paper can be found here.

  • Fyi, Monero uses one-time public key P = Hs(rA || i)G + B and P = xG, where recipient recovers the one-time private key as x = Hs(aR || i)G + b. How to find b in this case? (Note: i is the index of an output in a Tx and || is concatenation)
    – JollyMort
    Commented Feb 19, 2017 at 13:32
  • in your notation, what is the viewkey? attacker knows Hs(...) because of bad random/leaked viewkey, knows x, so using x = b + Hs(...) allows you to produce b = x - Hs(...)
    – bekah
    Commented Feb 20, 2017 at 13:40
  • a is the view key, b the spend key, P=xG the one-time key-pair. But how does an attacker know x in the first place?
    – JollyMort
    Commented Feb 20, 2017 at 14:50
  • the attack setting assumes a leaked derived private key :)
    – bekah
    Commented Feb 20, 2017 at 15:16
  • ah, so leaked x and the view key. got it :)
    – JollyMort
    Commented Feb 20, 2017 at 15:24

As far as I'm aware, there were no "formal" reviews, as in an outside third party is hired for the purpose, and publishes a review document.

The Cryptonote whitepaper was reviewed by a cryptographer, and an informal review is available (https://downloads.getmonero.org/whitepaper_review.pdf).

Some of the code was kinda reviewed by way of being forked and maintained by the new Monero developers, and some bugs fixed, but that's probably not quite what you're after.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.