Negative leave target amounts bypass proto validation

Imported from Codex security findings CSV codex-security-findings-2026-05-12T19-29-42.462Z.csv.

Triage status: imported scanner finding, not yet validated by a human.

Scanner Metadata

• Finding URL: https://chatgpt.com/codex/cloud/security/findings/b289689254388191b6e21a6d4b949978
• Repository: lightninglabs/darepo-client
• Severity: informational
• Scanner status: new
• Detected at: 2026-05-12T18:29:00.747663Z
• Commit: b152dc7ea98590bfe50e34452ccf5d0b75501141
• Committed at: 2026-04-24 17:02:05 -0700
• Author email: laolu32@gmail.com
• Has patch: false
• Configured scan ID: user-SFHXEfRY6GFhQZ5usE2FvSk3:github-1095286530

Relevant Paths

• round/from_proto.go
• rpc/roundpb/round.proto
• rpc/roundpb/convert.go
• round/transitions.go

Original Finding

Original Title

Negative leave target amounts bypass proto validation

Original Description

Before this change, JoinRoundRequest.FromProto converted leave outputs via roundpb.TxOutFromProto, which explicitly rejected negative output values because they corrupt fee calculations. The new LeaveRequest wire format exposes target_amount_sat directly, but FromProto assigns it to wire.TxOut.Value without checking that it is non-negative. A malformed JoinRoundRequest can therefore materialize a LeaveRequest with a negative output value. Any component using this parser on untrusted round RPC input can then feed the negative value into output summing, fee accounting, or transaction construction paths, causing incorrect accounting, validation bypasses, or denial of service when an invalid transaction output is later processed. This does not appear to create a direct client fund-theft path in the currently registered server-push routes, but it is a validation regression on a money-valued untrusted protobuf field.

Original CSV Row

finding_url: https://chatgpt.com/codex/cloud/security/findings/b289689254388191b6e21a6d4b949978
repository: lightninglabs/darepo-client
repository_url: https://github.com/lightninglabs/darepo-client
title: Negative leave target amounts bypass proto validation
description: Before this change, JoinRoundRequest.FromProto converted leave outputs via roundpb.TxOutFromProto, which explicitly rejected negative output values because they corrupt fee calculations. The new LeaveRequest wire format exposes target_amount_sat directly, but FromProto assigns it to wire.TxOut.Value without checking that it is non-negative. A malformed JoinRoundRequest can therefore materialize a LeaveRequest with a negative output value. Any component using this parser on untrusted round RPC input can then feed the negative value into output summing, fee accounting, or transaction construction paths, causing incorrect accounting, validation bypasses, or denial of service when an invalid transaction output is later processed. This does not appear to create a direct client fund-theft path in the currently registered server-push routes, but it is a validation regression on a money-valued untrusted protobuf field.
severity: informational
status: new
detected_at: 2026-05-12T18:29:00.747663Z
committed_at: 2026-04-24 17:02:05 -0700
author_email: laolu32@gmail.com
assignee_name: 
assignee_email: 
has_patch: false
configured_scan_id: user-SFHXEfRY6GFhQZ5usE2FvSk3:github-1095286530
commit_hash: b152dc7ea98590bfe50e34452ccf5d0b75501141
relevant_paths: round/from_proto.go | rpc/roundpb/round.proto | rpc/roundpb/convert.go | round/transitions.go
resolution_reason: 

Start in round/from_proto.go and trace JoinRoundRequest.FromProto, then compare its leave-output handling with roundpb.TxOutFromProto in rpc/roundpb/convert.go. Check the target_amount_sat field in rpc/roundpb/round.proto and the related transitions in round/transitions.go. Done means malformed negative leave amounts are rejected consistently with other invalid output values, with coverage for the parsing path.