Bisq 1.10.3

Release notes

This is an important security update that closes several gaps in trade protocol validation, message authentication, and filter safety identified during our ongoing security audit.

Filter Safety

• Filter-provided added BTC nodes and seed nodes are disabled because those fields are not currently covered by the filter signature.
• Previously persisted filterProvidedBtcNodes and filterProvidedSeedNodes config values are ignored on startup.
• Filter-provided BTC fee receiver addresses are temporarily ignored; DAO donation addresses and Burning Man receiver addresses remain active.

Trade And API Safety

• The Core API rejects payment-start confirmation for trades that are already failed.
• Buyer-side deposit/DPT processing checks that the peer deposit transaction matches the local transaction before wallet or trade-state mutation.
• Delayed payout transactions must spend output zero of the matching deposit transaction.
• Stale deposit confirmation callbacks are ignored when they refer to an older deposit transaction.

Message Authentication

• Trade chat and ACK messages must be signed by the expected trade peer.
• Dispute opening messages must be signed by the declared dispute opener.
• Peer-opened dispute and dispute-result messages must be signed by the locally expected mediation, or refund agent.
• Invalid messages are ignored before dispute, chat, or persistence state is mutated.

See full release notes at: https://github.com/bisq-network/bisq/tree/release/v1.10.3/release-notes/1.10.3

Installation

Bisq does not use Apple's notarization process (see why). For that reason you will see that (misleading) alert:

Grant permissions by:

• run sudo xattr -rd com.apple.quarantine /Applications/Bisq.app in a terminal (type Terminal in the Apple search box)
• open Bisq again

More details can be found here.

For similar reasons you will get that warning at Windows: Windows protected your PC

• Click the More info button when prompted
• Click the Run anyway button when prompted

More details can be found here.

Verify download

See the verification and installation instructions in the Bisq Wiki.