T09 · Insecure Skill Coding Practices
Error
- Location
scripts/hire.sh:146- Finding
Blind Signing of Server-Supplied Solana Transactions
- Content
View full analysis
/dev/null) NONCE=$(echo "$INITIATE_RESPONSE" | jq -r '.nonce // ""') UNSIGNED_TX=$(echo "$INITIATE_RESPONSE" | jq -r '.unsignedTransaction // ""') PAYMENT_REQS=$(echo "$INITIATE_RESPONSE" | jq -r '.paymentRequirements // {}') SIGNED_TX=$(node -e " const fs = require('fs'); const bs58 = require('bs58').default || require('bs58'); const { Keypair, Transaction } = require('@solana/web3.js'); const keypairData = JSON.parse(fs.readFileSync('${KEYPAIR_FILE}')); const keypair = Keypair.fromSecretKey(Uint8Array.from(keypairData)); const txBuffer = Buffer.from('${UNSIGNED_TX}', 'base64'); const transaction = Transaction.from(txBuffer); transaction.partialSign(keypair); const signedBuffer = transaction.serialize({ requireAllSignatures: false }); console.log(signedBuffer.toString('base64')); " 2>&1) ``` ### Technical Analysis The script signs a serialized Solana transaction supplied entirely by the remote marketplace API. Before signing, it does not decode or validate: - Program IDs and invoked instructions - Source and destination token accounts - The expected USDC mint - The actual transferred amount - Account authority changes or approvals - Additional unexpected instructions - Fee payer and transaction fees - Whether the transaction corresponds to the displayed gig The order summary does no ...[truncated 1383 chars]- Remediation
View remediation