False-negative validation results in MINT transactions with invalid baton

Description

Users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user’s minting baton.

Recommendation

Update the slp-validate package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.2.1
• Patched version(s): 1.2.1

References

• GHSA-4w97-57v2-3w44
• CVE-2020-11072
• CWE-697
• CAPEC-310
• OWASP 2021-A6

Related Issues

• False-negative validation results in MINT transactions with invalid baton - slpjs - CVE-2020-11071
• False-positive validity for NFT1 genesis transactions - CVE-2020-15131
• False-positive validity for NFT1 genesis transactions in SLPJS - CVE-2020-15130
• Improper Input Validation in SocksJS-Node - CVE-2020-7693

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

slp-validate