GHSA-xfrc-7mj2-5xh9
Suggest an improvement- Source
- https://github.com/advisories/GHSA-xfrc-7mj2-5xh9
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-xfrc-7mj2-5xh9/GHSA-xfrc-7mj2-5xh9.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-xfrc-7mj2-5xh9
- Published
- 2020-09-03T17:14:51Z
- Modified
- 2020-08-31T18:44:53Z
- Summary
- Undefined Behavior in zencashjs
- Details
-
Versions of
zencashjsprior to 1.2.0 may cause loss of funds when used with cryptocurrency wallets. The package relies on a string comparison of the first two characters of a Horizen address to determine the destination address type of a transaction (P2PKH or P2SH). Due to the base58 address prefixes chosen in Horizen there exists the possibility of a clash of address prefixes for testnet P2PKH and mainnet P2SH addresses, testnet P2PKH addresses start with “zt” while a subset of mainnet P2SH addresses can also start with “zt”. The package interprets transactions sent to a “zt” P2SH address on mainnet as P2PKH transactions erroneously. Any funds sent to a mainnet P2SH multisignature address starting with “zt” will be sent to the wrong address and be lost.Recommendation
Upgrade to version 1.2.0 or later.
- Database specific
{ "cwe_ids": [], "github_reviewed": true, "github_reviewed_at": "2020-08-31T18:44:53Z", "nvd_published_at": null, "severity": "CRITICAL" }- References
Affected packages
npm / zencashjs
Package
- Name
- zencashjs
- View open source insights on deps.dev
- Purl
- pkg:npm/zencashjs