T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/lib.sh:37
- Finding
- Signed Vote Authorization Can Be Sent to an Untrusted Configurable Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib.sh:37-53`, with the network sink at `scripts/vote.sh:234-242` **Vulnerability Type**: Unvalidated security-sensitive network destination **Risk Level**: Medium ### Vulnerable Code ```bash load_config() { [ -f "$CONFIG_FILE" ] || err "Config file not found: $CONFIG_FILE" WALLET="$(jq -r '.wallet // empty' "$CONFIG_FILE")" SPACE="$(jq -r '.space // empty' "$CONFIG_FILE")" SNAPSHOT_API="$(jq -r '.snapshotApiUrl // empty' "$CONFIG_FILE")" SEQUENCER="$(jq -r '.snapshotSequencer // empty' "$CONFIG_FILE")" [ -n "$WALLET" ] || err "Missing config.wallet" [ -n "$SPACE" ] || err "Missing config.space" [ -n "$SNAPSHOT_API" ] || err "Missing config.snapshotApiUrl" [ -n "$SEQUENCER" ] || err "Missing config.snapshotSequencer" normalize_wallet "$WALLET" >/dev/null } ``` The selected configuration file can also be overridden through an environment variable: ```bash CONFIG_FILE="${GOTCHI_DAO_CONFIG_FILE:-$SCRIPT_DIR/../config.json}" ``` After obtaining a valid Bankr signature, the script sends the signed payload to the unvalidated endpoint: ```bash jq -n \ --arg address "$WALLET" \ --arg sig "$SIGNATURE" \ --slurpfile data "$TMP_TYPED" \ '{address:$address,sig:$sig,data:$data[0]}' > "$TMP_PAYLOAD" VOTE_RESPONSE="$(curl -sS -X POST "$SEQUENCER" -H "Content-Type: application/json" -d @"$TMP_PAYLOAD")" ``` ### Technical Analysis The `snapshotSequencer` configuration value is only checked for non-emptiness. The code does not verify its scheme, hostname, port, or origin before sending a security-sensitive payload to it. The transmitted payload contains: - The user's wallet address. - The complete EIP-712 typed vote. - The vote choice and proposal identifier. - A valid Bankr-generated signature authorizing that exact vote. The bundled configuration points to the legitimate `https://seq.snapshot.org/` endpoint. However, a modified `config.json` or attacker-controlled `GOTCHI_ ...[truncated 1926 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Allowlist the official sequencer** - Require the normalized destination to match the intended origin, such as `https://seq.snapshot.org/`. - Reject alternate hosts, non-HTTPS schemes, embedded user information, and unexpected ports. 2. **Avoid configurable production security boundaries** - Hard-code the trusted Snapshot sequencer for normal operation. - If endpoint overrides are needed for testing, require an explicit development flag and clearly warn that signed data will be sent to a non-production destination. 3. **Validate before signing** - Validate the sequencer destination before calling Bankr so a signature is never generated when the eventual recipient is untrusted. - Display the validated destination before requesting the signature. 4. **Protect configuration integrity** - Require the configuration file to be owned by the current user and not writable by other users. - Treat `GOTCHI_DAO_CONFIG_FILE` as a privileged override and disable it in production execution where possible. 5. **Use strict network behavior** - Continue requiring TLS certificate verification. - Add suitable connection and request timeouts. - Do not follow redirects to a different origin for requests carrying signed authorization data. ]]>