Skip to content

False-negative validation results in MINT transactions with invalid baton

Critical severity GitHub Reviewed Published May 11, 2020 in simpleledger/slpjs • Updated Jan 9, 2023

Package

npm slpjs (npm)

Affected versions

< 0.27.2

Patched versions

0.27.2

Description

Impact

Users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton.

Patches

npm package slpjs has been patched and published as version 0.27.2.

Workarounds

Upgrade to slpjs 0.27.2.

References

For more information

If you have any questions or comments about this advisory:

References

@jcramer jcramer published to simpleledger/slpjs May 11, 2020
Reviewed May 12, 2020
Published to the GitHub Advisory Database May 12, 2020
Last updated Jan 9, 2023

Severity

Critical

EPSS score

0.090%
(40th percentile)

Weaknesses

CVE ID

CVE-2020-11071

GHSA ID

GHSA-jc83-cpf9-q7c6

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.