False-negative validation results in MINT transactions with invalid baton

Description

Users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user’s minting baton.

Recommendation

Update the slpjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.27.2
• Patched version(s): 0.27.2

References

• GHSA-jc83-cpf9-q7c6
• CVE-2020-11071
• CWE-697
• CAPEC-310
• OWASP 2021-A6

Related Issues

• False-positive validity for NFT1 genesis transactions in SLPJS - CVE-2020-15130
• Improper Input Validation in SocksJS-Node - CVE-2020-7693
• XSS due to lack of CSRF validation for replying/publishing - CVE-2020-15156
• Improper Validation and Sanitization in url-parse - CVE-2020-8124

Tags:

npm

slpjs