Executive brief
A vulnerability in the slpjs library, which is used to validate Simple Ledger Protocol (SLP) tokens on the Bitcoin Cash network, could allow an attacker to bypass transaction rules. By using specially crafted scripts, an attacker could cause the validator to disagree with the network's consensus rules. This could lead to a 'hard-fork' where the library incorrectly validates fraudulent transactions, potentially resulting in financial discrepancies or loss of trust in token balances.
Technical details
A vulnerability exists in the slpjs npm package due to a parsing discrepancy in how the validator handles string encoding within Bitcoin scripts. An attacker with the ability to broadcast specially crafted Bitcoin scripts can trigger a validation result that differs from the official SLP consensus rules. This is classified as improper input validation (CWE-20). If exploited, this discrepancy can cause the library to recognize invalid transactions as valid, leading to a hard-fork from the intended consensus state. The issue is fixed in version 0.21.4.
Affected products
- Simple Ledger Protocol slpjs < 0.21.4
Timeline
- 2019-11-15: disclosed
- 2019-11-15: patched
- 2019-11-15: advisory