CVE-2020-11071: Vulnerability in slpjs package allows false-negative validation results in MINT transactions
Summary
CVE-2020-11071: False-negative validation results in MINT transactions with invalid baton. Affects slpjs versions < 0.27.2. Fixed in 0.27.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The slpjs package is an npm package that provides functionality for working with Simple Ledger Protocol (SLP) tokens. SLP is a token protocol built on top of the Bitcoin Cash (BCH) blockchain. It allows users to create, send, and manage tokens on the BCH network. The slpjs package is commonly used by developers to interact with SLP tokens in their applications.
Vulnerability Detail
The vulnerability in the slpjs package allows for false-negative validation outcomes in MINT transaction operations. This means that a poorly implemented SLP wallet could incorrectly validate a MINT transaction as valid when it is actually invalid. As a result, users could spend affected tokens, leading to the destruction of their minting baton. This vulnerability has a CVSS score of 8.6, indicating a critical severity level.
How To Fix
Latest published version: 0.27.11 as of 23 Oct 2026
npm install slpjs@0.27.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.27.2
This is the first release that contains the fix.
npm install slpjs@0.27.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the patched version of the slpjs package.
Conclusion
The slpjs package has a vulnerability that allows for false-negative validation outcomes in MINT transactions. This can result in the destruction of a user's minting baton. To fix this vulnerability, it is recommended to upgrade to version 0.27.2 of the slpjs package. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for slpjs →
FAQ
The slpjs package is an npm package used for working with Simple Ledger Protocol (SLP) tokens on the Bitcoin Cash (BCH) blockchain.
A MINT transaction is an operation in the SLP token protocol that allows for the creation of new tokens.
A minting baton is a special token that grants the ability to create new tokens in the SLP token protocol.
False-negative validation outcomes occur when a validation process incorrectly identifies a transaction as valid when it is actually invalid.
The impact of this vulnerability is that users could spend affected tokens, leading to the destruction of their minting baton.
References
Related vulnerabilities
Recent vulnerabilities recorded for slpjs.
