Skip to content
OpenAdvisories
High · 7.5 CVE-2020-15131 EUVD-2020-0540GHSA-6jmr-jfh7-xg3h

False-positive validity for NFT1 genesis transactions in SLP Validate

Published Jul 30, 2020 · Updated Aug 4, 2024 · Assigned by GitHub_M

Description

In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 1.2.2.

Affected products

VendorProductAffectedFixed
simpleledger slp-validate.js < 1.2.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm slp-validate < 1.2.2 1.2.2 GHSA-6jmr-jfh7-xg3h

References