T09 · Insecure Skill Coding Practices
Error
- Location
mya.py:1442- Finding
Server-Controlled Financial Transactions Are Signed Without Semantic Validation
- Content
View full analysis
bool: try: tx = SoldersTransaction.from_bytes(tx_bytes) message = tx.message if not message.recent_blockhash or message.recent_blockhash == Hash.default(): Output.error("Transaction missing blockhash") return False if not any(str(acc) == expected_signer for acc in message.account_keys): Output.error("Transaction missing signer") return False return True except Exception as e: Output.error("Transaction verification failed") log_error(f"TX verify: {e}") return False ``` The launch workflow signs the remotely returned transaction after applying only the weak check above: ```python tx_bytes = base64.b64decode(prepare_result.data["transaction"]) mint_address = prepare_result.data["mintAddress"] if not verify_transaction(tx_bytes, creator_address): Output.error("Transaction verification failed") sys.exit(ExitCode.SECURITY_ERROR) tx = SoldersTransaction.from_bytes(tx_bytes) tx.sign([keypair], tx.message.recent_blockhash) signed_tx_b64 = base64.b64encode(bytes(tx)).decode() ``` Poker escrow workflows do not perform even this limited validation: ```python if escrow and escrow.get('unsignedTx'): print("Signing escrow deposit transaction...") try: tx_bytes = base64.b64decode(escrow['unsignedTx']) tx = SoldersTransaction.from_bytes(tx_bytes) signed_tx = wallet.sign_transaction(tx) signed_b64 = base64.b64encode(bytes(signed_tx)).decode('utf-8') with Spinner("Confirming on-chain deposit..."): ...[truncated 3224 chars]- Remediation
View remediation