Executive brief
slp-validate is a JavaScript library used to validate Simple Ledger Protocol (SLP) transactions on the Bitcoin Cash blockchain. Versions prior to 1.2.2 incorrectly mark certain invalid NFT1 child token creation transactions as valid, allowing attackers or poorly-implemented wallets to create fraudulent tokens without the required token burns, undermining the integrity of NFT1 token issuance.
Technical details
The vulnerability is a validation bypass (CWE-697) in the NFT1 Child Genesis transaction validation logic. The slp-validate library fails to properly enforce the NFT1 specification requirement that valid NFT1 child token genesis transactions must burn the corresponding NFT1 Group token. An attacker can submit a transaction that passes validation but violates the protocol specification, allowing creation of unauthorized NFT1 child tokens. The vulnerability affects all versions before 1.2.2 and is fixed by patching the validation rules. No authentication or special privileges are required to exploit this; any actor can submit malformed transactions to the blockchain.
Affected products
- Simple Ledger Protocol slp-validate < 1.2.2
Timeline
- 2020-07-30: disclosed
- 2020-07-30: patched: Version 1.2.2 released