Training Example: Feather Wallet – Review the Data, Give Your Score & Compare to the Real AI Evaluation

[H1] Feather: A Free Monero Desktop Wallet

Home
|

Download
|

Changelog
|

Screenshots
|

Docs
|

Help
Feather is a free, open-source Monero wallet for Linux, Tails, Windows and macOS.
The source code is available at github.com/feather-wallet/feather.
easy-to-use, small and fast - Feather runs well on any modern hardware, including virtual machines and live operating systems.
beginner friendly, but also caters to advanced Monero users by providing a feature set that is on par with the official CLI.
ships with sane defaults that suit most users, but can also be configured for high or uncommon threat models.
serves as a testing grounds for experimental features that may later be adopted in the reference wallets.
The latest version is 2.8.1.
Download it here.

Clearnet
|

Onion
|

I2P

[H1] Feather: A Free Monero Desktop Wallet

Home
|

Download
|

Changelog
|

Screenshots
|

Docs
|

Help

[H1] Latest release: 2.8.1
(2025-04-14)
Need help installing Feather? Check the docs.

Architecture
Download
PGP Signature
Size

Linux (glibc >= 2.31)
x64
Standalone executable
signature
29 MB

AppImage
signature
27 MB

ARM32 (Raspberry Pi)
AppImage
signature
23 MB

ARM64
AppImage
signature
25 MB

RISC-V (64-bit)
AppImage
signature
27 MB

Tails / Whonix
x64
AppImage
signature
24 MB

Flatpak
x64
Instructions

Windows (10 and higher)
x64
Installer
signature
19 MB

Standalone executable
signature
25 MB

macOS (12 and higher)
Intel
Application Bundle
signature
24 MB

Apple Silicon
Application Bundle
signature
23 MB

Source archive
.tar.gz
signature
24 MB

A GPG-signed list of the hashes can be found here. The signing key can be found in our Git repo, here.

Clearnet
|

Onion
|

I2P

[H1] Feather: A Free Monero Desktop Wallet

Home
|

Download
|

Changelog
|

Screenshots
|

Docs
|

Help
[H3] Home
Fiat price display
Crowdfunding proposals, Bounties, Revuo Monero
[H3] History
Detailed transaction history
Historical fiat prices
Export as CSV
Rebroadcast failed transactions
Create transaction proofs
[H3] Nodes
Overview of community hosted remote nodes
Switch between remote nodes
Maintain your own list of nodes
[H3] Send
Scan QR code
Send fiat amount
Send entire balance
Multi destination transactions
Advanced transaction details
Export unsigned / signed transaction
[H3] Receive
QR code display
Edit subaddress labels
Create payment requests
Automatically hides used addresses
Search addresses and labels
[H3] Coins
Detailed output information
Freeze & thaw individual coins
Sweep selected outputs
[H3] Calc
Fiat/crypto price conversion calculator
[H3] Contacts
[H3] Tools > Sign/verify
Sign/verify messages with (sub)address
[H3] Tools > Verify transaction proof
Verify SpendProofs, OutProofs, InProofs
[H3] Tools > Broadcast transaction
Broadcast raw transaction to specified node
[H3] 14 word seeds
With embedded restore height
[H3] Alternative themes
Qdarkstyle
Breeze Dark
Breeze Light

Clearnet
|

Onion
|

I2P

[H1] Feather: A Free Monero Desktop Wallet

Home
|

Download
|

Changelog
|

Screenshots
|

Docs
|

Help
[RSS]
2.8.1 changelog (2025-04-14)
Windows: fixed a crash on startup if the path to the executable contains unicode characters.
macOS: the minimum macOS version is now 12.
Qt silently dropped support for macOS 11 in Qt v6.8.0, which caused Feather 2.8.0 to crash on startup on macOS 11.
macOS 11 has been unsupported by Apple for over 18 months. Users are strongly advised to upgrade their operating system.
Flatpak: should now be able to locate and use the host cursor theme.
If you still experience cursor issues after this release, make sure that /usr/share/icons/default/index.theme is not a symlink.
Wizard: when trying to restore a 25-word seed, Feather should no longer incorrectly report that the checksum word is invalid.
About: added a tab that shows version numbers of some components.
Revuo: added a separator between the “Recent news” and “Upcoming events” section.
Qt was updated to v6.9.0
Tor was updated to v0.4.8.16
OpenSSL was updated to v3.5.0
2.8.0 changelog (2025-03-30)
Fixes & Improvements:
History: CSV export: it is now possible to select a date range and to specify if only incoming, outgoing, or miner transactions should be exported.
History: CSV export: fixed an issue that could cause the “balanceDelta” field to show an unrealistic value.
Send: the address-book functionality was moved from the Send tab to a new ‘Contacts’ tab.
Send: added a placeholder text to the ‘Pay To’ field to inform users that pasting a QR code, OpenAlias, or payment URI is possible.
Send: fixed an issue where a transaction description set in the advanced transaction dialog would not get saved.
Send: fixed an issue where scanning a payment URI using the QR scanner would dump the full payment URI in the address field.
Receive: it is now possible to enter a fiat amount in payment request dialog. The fiat amount is automatically converted to the approximate XMR amount.
Receive: an address is now considered ‘used’ as soon as it receives an output in the transaction pool.
Receive: if no unused addresses are available, a new address will automatically be generated.
Receive: fixed an issue that could cause pinned subaddresses to not appear at the top of the list
Receive: fixed an issue that would clear the subaddress selection when the wallet scans a new block.
Coins: improved performance when freezing/thawing a large number of outputs.
Added a ‘Notes’ tab for adding arbitrary notes. The notes are stored in the wallet cache.
Mining: the Mining plugin is deprecated and will be removed in an upcoming version.
Settings: added an option to hide the window to the system tray when minimized.
Settings: added an option to hide the system tray icon.
Account switcher: fixed an issue where opening the account switcher would cause the wallet to switch to the primary account on some platforms.
Address checker: will now show a warning if the address contains keys that are not in the main subgroup.
Status bar: clicking on the balance will now show the fiat value of the {unconfirmed, spendable, total} balance in the preferred fiat currency.
Docs: the dialog will no longer close when pressing enter.
Wizard: automatically add a space at the end when auto-completing words in mnemonic seeds.
Wizard: when restoring a non-deterministic wallet from keys, a more helpful error message is now shown if the primary address does not correspond to the private keys.
Wizard: when attempting to restore a 25-word seed, an error message is shown if the checksum word is invalid.
Ledger: show the reconnect dialog if the device was locked during synchronization.
Misc: (approximate) restore dates are now always shown next to restore heights.
Misc: performance and memory usage optimizations
Misc: minor user interface tweaks
Misc: Feather will no longer attempt to restart itself in the event of a crash, which could cause crash loops if the crash happened before any UI was shown.
Build: Windows and macOS release binaries are now code-signed.
Build: Feather now has native Wayland support.
Build: Linux and Windows targets are now built with GCC 13.3.0 (was 12.4.0)
Build: macOS targets are now built with LLVM 18 (was 10)
Build: support for the 32-bit Linux target was removed.
Flatpak: will now default to Wayland if available.
Tails: creating a desktop entry will now persist if dotfiles persistence is enabled.
macOS: the minimum supported macOS version is now 11.0
Removed the Prestium integration.
Monero was updated to version v0.18.4.0
Qt was updated to version v6.8.3 (was v6.7.3)
Tor was updated to version 0.4.8.14
2.7.0 changelog (2024-10-08)
history: always show the integrated address in the destinations table if an outgoing transaction has a payment id
in some cases, the base address was shown when a payment had been made to an integrated address
this issue could lead to a potential loss of funds if a repeat payment was made to a service and the address was copied from the dialog without verifying it
a report of this issue was rewarded with a bug bounty of 2.5 XMR
on wallets backed by Trezor hardware devices, a warning is shown instead, because the payment id is not stored correctly
history: you can now import transaction descriptions from a CSV file
send: improved an error message that is shown when a transaction tries to spend too many inputs
contacts: paying to a contact now auto-fills the contact name in the transaction description
coins: ‘send to self’ now sends funds to the change address of the current account instead of the primary account
settings: added an option to show fiat balance in the statusbar
nodes: nodes ending with a ‘.local’ tld are now considered local nodes
nodes: added (more) nodes by plowsof and ofrnxmr to the default list, removed hashvault
wizard: improved an error message that is shown when the cache file can’t be read
wizard: fixed an input validation issue on the set lookahead page that could lead to a crash
revuo: issues now include upcoming events
macos: fixed an issue that could prevent the application from launching
flatpak: dates shown in the application should now reflect the system time
show a notification when a mining payment is received
fixed an issue that could prevent the application from closing
fixed a few memory leaks
updated Qt to 6.7.3
updated OpenSSL to 3.3.2
2.6.8 changelog (2024-08-15)
updated Monero to v0.18.3.4
updated Qt to 6.7.2
updated Tor to 0.4.8.12
removed Reddit and LocalMonero plugins
windows: fixed a graphical issue if windows dark mode was enabled
trezor: re-enabled bridge transport
tx pool viewer: fixed table sort
settings: fixed a potential crash
wizard: don’t allow illegal chars in file name
linux: minimum glibc is now 2.31
update your machine to Debian 11, Ubuntu 20.04 or later
Incident report: Denial-of-Service (28 April 2024) (2024-05-01)
[H3] Summary
Feather versions 2.6.5 and below are no longer able to send transactions. Upgrade Feather to 2.6.6 or above to fix the issue.
Users trying to construct a transaction on 2.6.5 and below are presented with the following error message: “Internal error: Unrealistic number of outputs in output distribution”.
The bug was triggered when the number of RingCT outputs on the blockchain exceeded 100 million. This caused a sanity check to fail during transaction construction, resulting in the error shown above.
For approximately 5 hours on April 28, 2024, all available versions were affected by the bug, effectively preventing anyone from transferring funds using Feather during that time.
[H3] Cause
On August 29, 2021, I committed a patch titled ‘Output distribution checks’ to Feather’s fork of the core Monero wallet library. This patch was first included in Feather beta-9, which was released on September 16, 2021.
The purpose of this patch was to provide better mitigations against an attack known as “output distribution poisoning”.
The output distribution is a histogram of RingCT outputs and affects how the wallet selects decoys for rings. When a transaction is constructed, the wallet requests the output distribution from the node it is connected to.
In the attack, a malicious remote node manipulates the output distribution in a way that reveals the true spend to the node with a high degree of certainty. One way a node could do this is by pretending there are significantly more outputs on the blockchain than there are in reality. This causes decoys, which are referenced by their global index, to skew towards this ‘unrealistic’ number.
Consider the following set of output indices which represent a ring, for which the wallet requests the associated public keys from the node:
{99655570, 50001410564, 50001585151, 50001818442, 50001853725, ...}
The node can clearly tell that the first output is the true spend, because it is the only ‘real’ output that exists on the blockchain.
This could allow the node to associate an output with an IP address. Note that, by default, Feather constructs transactions over Tor, and so the only information a node would learn is that “someone, using Tor, is currently trying to spend this output”. By default, Feather connects to a node from a list of nodes operated by known members of the community. If a node from this list was reported to be malicious, it can quickly be removed and the operator shunned.
In this naive approach, the transaction would be rejected by the network because the ring contains invalid indices. The user would receive an error message upon broadcasting the transaction and promptly switch to a different node.
A more sophisticated attacker could present the output distribution in a way where decoy selection is skewed such that the true spend is detectable, but does not result in an invalid transaction.
For instance, this transaction was constructed using a manipulated output distribution. Can you determine what the true spend is? Notice that all ring members are older than 1y 200d except for one 6-day-old output. Unless the user checks the ring on a block explorer and knows what to look out for, they would not notice that their transactions are being fingerprinted.
Even subtler manipulation may give the malicious node only a statistical edge to guess the true spend, but not noticeably fingerprint the transaction on-chain to a casual observer.
The patch attempted to mitigate this attack with two checks:
It hashes the output distribution returned by a node up until a checkpoint height and compares it against a hardcoded hash. If the hashes don’t match, an error is returned. This prevents any tampering with the distribution before the check-pointed height.
It checks if the total number of outputs in the distribution does not exceed a predefined limit. This ‘sanity check’ is what ultimately caused transaction construction to fail for everyone when the real number of outputs on the blockchain exceeded this limit.
Upon further review, the first check appears to be an effective measure, as long as it is updated with each release. It limits how much an attacker is able to skew decoy selection. The second check appears to be ineffective, as an informed attacker could still skew the distribution to just below the limit. It would only have caught an attacker that was unaware of the limit.
I initially stated that “a large number of outputs were added last month in a spam attack”, believing the patch was a more recent invention and thought the spam attack had contributed more significantly to expediting the timeline. After gathering the details, I found that the attack only contributed about 2.5 months' worth of outputs to the chain. Moreover, the possibility of such an attack should have been taken into account when considering if was a good idea to impose any such limit in the first place.
At the time of the patch (Aug 2021) roughly 48.8 million RingCT outputs existed on the Monero blockchain. The limit was set to 100 million.
The limit and the hardcoded hash were never updated from their initial values.
By March 3, 2024, at the start of the March spam attack, the number of RingCT outputs on the Monero blockchain had already grown to 90.8 million.
According to research by Rucknium, the spam attack added about 4.62 or 4.71 million outputs depending on which definition is used for the spam transactions.
Updating the limit or hardcoded hash was not documented in the release procedure or maintenance priority and the value was not actively monitored. These documents were added precisely to prevent something like this from happening, but were only introduced in Jan 2023. By then, the existence of the patch must not have been top of mind.
On April 28, 2024, block 3137429 was mined which pushed the number of RingCT outputs over the 100 million limit, triggering the sanity check to fail during transaction construction.
Plans to clean up Feather’s patchset with the goal of “upstreaming as much as possible” were on the agenda. I believe I would have removed the limit if I had worked on this sooner, however this obviously did not happen before the limit was reached. Following the CCS hack, I prioritised work to help ensure the continuity of the CCS, which included finalising support for offline transaction signing with animated QR codes and ongoing work to integrate multisig. This lead to delays in maintenance work.
I conclude that the sanity check should not have been added, and that my failure to properly document, monitor, and maintain the patch ultimately lead to the denial of service.
[H3] Response Timeline
[H4] 2.6.6
20:40 - User miracloe joins the irc channel and is the first person to report that they encountered the error message.
20:46 - I am able to reproduce the error message by attempting to send a test transaction.
To prevent this from happening in the future, the sanity check is removed.
21:41 - The 2.6.6 release is tagged and building begins.
00:04 - The builds are finished and transferred to the release signing machine.
00:13 - Builds are signed and uploading begins.
01:15 - Uploading is finished and the release is available on the site and in the built-in updater.
Report ➛ Tag
Tag ➛ Release
Report ➛ Release
1h 1m
3h 34m
4h 35m
‘Report to Tag’ is the amount of time it took to reproduce, debug and fix the issue.
‘Tag to Release’ is the amount of time it took to release the update, which includes building, signing, and uploading the release artifacts and updating the website.
For most users this concluded the wait, others had to wait until 2.6.7.
[H4] 2.6.7
01:49 - User rayven123 reports on irc they are unable to open 2.6.6 on Tails 5.
01:57 - I am able to reproduce the issue by attempting to open 2.6.6 on Tails 5.
This problem turned out to be related to a compiler upgrade, and was unrelated to the fix for the output distribution issue. It had existed in the master branch since March 18, but went unnoticed because the issue did not affect my development machine.
Since all versions prior to