CVE-2020-11072: slp-validate - False-negative validation results in MINT transactions with invalid baton
Summary
CVE-2020-11072: False-negative validation results in MINT transactions with invalid baton. Affects slp-validate versions < 1.2.1. Fixed in 1.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The slp-validate package is an npm package used for validating Simple Ledger Protocol (SLP) transactions. SLP is a token protocol built on top of the Bitcoin Cash (BCH) blockchain. The slp-validate package provides functionality to validate SLP transactions, including MINT transactions which are used for minting new tokens. This vulnerability affects versions prior to 1.2.1 of the slp-validate package.
Vulnerability Detail
The vulnerability in slp-validate allows for false-negative validation outcomes for MINT transaction operations. This means that a poorly implemented SLP wallet could incorrectly validate an invalid MINT transaction, allowing the spending of affected tokens. This can result in the destruction of a user's minting baton, which is a critical component for managing token minting. The vulnerability originates from a flaw in the validation logic of the slp-validate package.
How To Fix
Minimum fixed version
1.2.1
This is the first release that contains the fix.
npm install slp-validate@1.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the patched version of the slp-validate package.
Conclusion
In conclusion, the slp-validate package prior to version 1.2.1 is vulnerable to false-negative validation outcomes for MINT transactions. This can result in the destruction of a user's minting baton and potential spending of affected tokens. It is recommended to upgrade to version 1.2.1 of the slp-validate package to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for slp-validate →
FAQ
The impact of this vulnerability is that users could experience false-negative validation outcomes for MINT transactions. This can lead to the destruction of a user's minting baton and potentially allow spending of affected tokens.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and Vulert will analyze it for vulnerabilities in real-time.
Simple Ledger Protocol (SLP) is a token protocol built on top of the Bitcoin Cash (BCH) blockchain. It allows for the creation and management of tokens on the BCH network.
A MINT transaction is a type of transaction in the SLP protocol that is used for minting new tokens. It allows the creation of additional tokens by adding them to the token supply.
To upgrade to the patched version of slp-validate (1.2.1), you can run the following command: npm install slp-validate@1.2.1
References
Related vulnerabilities
Recent vulnerabilities recorded for slp-validate.
