Executive brief
zencashjs is a JavaScript library for interacting with Horizen cryptocurrency wallets. Due to a flaw in address type detection, funds sent to mainnet multisignature (P2SH) addresses beginning with "zt" are misrouted to single-signature (P2PKH) addresses and permanently lost, as the library confuses these address types based on a prefix string comparison.
Technical details
The vulnerability is a logic error in address type classification: zencashjs determines transaction destination type by comparing the first two characters of a Horizen address string, but the base58 encoding scheme used for Horizen addresses creates an overlap where testnet P2PKH addresses and a subset of mainnet P2SH addresses both begin with "zt". The library incorrectly interprets "zt"-prefixed mainnet P2SH addresses as testnet P2PKH addresses. This is a network-adjacent (local wallet operation) vulnerability affecting any user creating multisignature transactions to addresses starting with "zt" on the Horizen mainnet. An attacker controlling a wallet can either intentionally exploit this to send funds to an uncontrolled address, or users may accidentally trigger the flaw. The fix in version 1.2.0 improves address type detection to correctly distinguish between P2PKH and P2SH addresses regardless of prefix.
Affected products
- Horizen zencashjs before 1.2.0
Timeline
- 2020-09-03: disclosed