Skip to content

False-positive validity for NFT1 genesis transactions in SLPJS

Critical severity GitHub Reviewed Published Jul 29, 2020 in simpleledger/slpjs • Updated Jan 9, 2023

Package

npm slpjs (npm)

Affected versions

< 0.27.4

Patched versions

0.27.4

Description

Impact

In the npm package named "slpjs", versions prior to 0.27.4 are vulnerable to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification.

Patches

npm package "slpjs" has been patched and is published and tagged as version 0.27.4.

Workarounds

Upgrade to slpjs 0.27.4.

References

For more information

If you have any questions or comments about this advisory please open an issue in the slp-validate repository.

References

@jcramer jcramer published to simpleledger/slpjs Jul 29, 2020
Reviewed Jul 30, 2020
Published to the GitHub Advisory Database Jul 30, 2020
Last updated Jan 9, 2023

Severity

Critical

EPSS score

0.071%
(32nd percentile)

Weaknesses

CVE ID

CVE-2020-15130

GHSA ID

GHSA-cc2p-4jhr-xhhx

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.