T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib.sh:37- Finding
Signed Vote Authorization Can Be Sent to an Untrusted Configurable Endpoint
- Content
View full analysis
/dev/null } ``` The selected configuration file can also be overridden through an environment variable: ```bash CONFIG_FILE="${GOTCHI_DAO_CONFIG_FILE:-$SCRIPT_DIR/../config.json}" ``` After obtaining a valid Bankr signature, the script sends the signed payload to the unvalidated endpoint: ```bash jq -n \ --arg address "$WALLET" \ --arg sig "$SIGNATURE" \ --slurpfile data "$TMP_TYPED" \ '{address:$address,sig:$sig,data:$data[0]}' > "$TMP_PAYLOAD" VOTE_RESPONSE="$(curl -sS -X POST "$SEQUENCER" -H "Content-Type: application/json" -d @"$TMP_PAYLOAD")" ``` ### Technical Analysis The `snapshotSequencer` configuration value is only checked for non-emptiness. The code does not verify its scheme, hostname, port, or origin before sending a security-sensitive payload to it. The transmitted payload contains: - The user's wallet address. - The complete EIP-712 typed vote. - The vote choice and proposal identifier. - A valid Bankr-generated signature authorizing that exact vote. The bundled configuration points to the legitimate `https://seq.snapshot.org/` endpoint. However, a modified `config.json` or attacker-controlled `GOTCHI_ ...[truncated 1926 chars]- Remediation
View remediation