aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/core.cpp7
1 files changed, 7 insertions, 0 deletions
diff --git a/src/core.cpp b/src/core.cpp
index 491e4fa68b..e52327ba8e 100644
--- a/src/core.cpp
+++ b/src/core.cpp
@@ -226,6 +226,13 @@ uint256 CBlockHeader::GetHash() const
uint256 CBlock::BuildMerkleTree() const
{
+ // WARNING! If you're reading this because you're learning about crypto
+ // and/or designing a new system that will use merkle trees, keep in mind
+ // that the following merkle tree algorithm has a serious flaw related to
+ // duplicate txids, resulting in a vulnerability. (CVE-2012-2459) Bitcoin
+ // has since worked around the flaw, but for new applications you should
+ // use something different; don't just copy-and-paste this code without
+ // understanding the problem first.
vMerkleTree.clear();
BOOST_FOREACH(const CTransaction& tx, vtx)
vMerkleTree.push_back(tx.GetHash());