Executive brief
Solana Pay is a blockchain payment protocol used to accept cryptocurrency transactions at point-of-sale terminals. A weakness in its transfer validation function could allow an attacker to craft transactions that pass validation checks but incorrectly validate multiple transfers instead of a single intended transfer. While most deployments use physical devices where exploitation is unlikely, web-based point-of-sale implementations are at higher risk of abuse.
Technical details
The validateTransfer function in Solana Pay contains a logic weakness in how it processes transactions located by reference key. An edge case in the validation mechanism can cause it to validate multiple transfers in a single transaction when only one was intended, potentially allowing acceptance of improper payments. The vulnerability is rooted in insufficient transaction validation logic (CWE-670). No authentication is required; the attack vector is network-based and depends on a merchant application using the vulnerable validation function. The issue has been patched in version 0.2.1 of the @solana/pay SDK.
Affected products
- Solana Labs @solana/pay <=0.2.0
Timeline
- 2022-07-28: disclosed
- 2022-08-06: patched: Fixed in version 0.2.1