T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/add-wallet.js:13- Finding
Caller-Controlled User Identifier Allows Cross-User Data Access and Modification
- Content
View full analysis
= 5) { process.exit(1); } const added = addWallet(user.id, address); ``` #### `scripts/get-pnl.js:17-77` ```js const telegramId = process.argv[2]; async function main() { const user = findOrCreateUser(telegramId, ''); const wallets = getUserWallets(user.id); if (!wallets || wallets.length === 0) { process.exit(0); } const portfolio = await getPortfolio(user.id); if (!portfolio.holdings || portfolio.holdings.length === 0) { process.exit(0); } const pnlRows = await getPortfolioPnl(user.id, portfolio.holdings); ``` #### `scripts/get-portfolio.js:14-40` ```js const telegramId = process.argv[2]; async function main() { const user = findOrCreateUser(telegramId, ''); const wallets = getUserWallets(user.id); if (!wallets || wallets.length === 0) { process.exit(0); } const portfolio = await getPortfolio(user.id); ``` #### `scripts/get-rebalance-suggestion.js:14-63` ```js const telegramId = process.argv[2]; const benchmarkArg = process.argv[3]; async function main() { try { const user = findOrCreateUser(telegramId, ''); const wallets = getUserWallets(user.id); if (!wallets || wallets.length === 0) { process.exit(0); } const portfolio = await getPortfolio(user.id); if (!portfolio || portfolio.isEmpty || po ...[truncated 4660 chars]- Remediation
View remediation