T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:252- Finding
Unauthenticated Wallet Daemon Permits Unauthorized Transfers and Withdrawals
- Content
View full analysis
{ if (req.method !== 'POST') { res.writeHead(405); res.end(); return; } const chunks: Buffer[] = []; for await (const chunk of req) chunks.push(chunk as Buffer); const { method, params } = JSON.parse(Buffer.concat(chunks).toString()); try { let result: any; switch (method) { case 'getBalance': result = await agent.getBalance(); result = { ...result, shares: result.shares.toString(), estimatedUSDC: result.estimatedUSDC.toString() }; break; case 'getAddress': result = { address: agent.getReceiveAddress() }; break; case 'transfer': result = await agent.transfer(params.to, toUSDC(params.amount), params.opts); result = { ...result, shares: result.shares.toString() }; break; case 'withdraw': result = await agent.withdraw(params.to, toUSDC(params.amount)); result = { ...result, shares: result.shares.toString() }; break; ``` Equivalent vulnerable dispatch in `examples.md:37-51`: ```typescript const server = createServer(async (req, res) => { if (req.method !== 'POST') { res.writeHead(405); res.end(); return; } const chunks: Buffer[] = []; for await (const chunk of req) chunks.push(chunk as Buffer); const { method, params } = JSON.parse(Buffer.concat(chunks).toString()); try { let result: any; switch (method) { case 'getBalance': result = await agent.getBalance(); break; case 'getAddress': result = { address: agent.getReceiveAddress() }; break; case 'transfer': result = await agent.transfer(params.to, toUSDC(params.amount), params.opts); break; case 'w ...[truncated 2343 chars]- Remediation
View remediation