T09 · Insecure Skill Coding Practices
Warning
- Location
src/index.ts:486- Finding
Incomplete Preflight Validation for Financial Transactions
- Content
View full analysis
{ const parsed = parseExtSym(t.symbol); return parsed?.symbol === sym; }); if (!token) { const available = tokens.map((t: any) => parseExtSym(t.symbol)?.symbol).filter(Boolean); return { error: `Token "${sym}" not supported. Available: ${available.join(', ')}` }; } if (!token.isMintEnabled) { return { error: `Minting with ${sym} is currently disabled` }; } const parsed = parseExtSym(token.symbol); if (!parsed) return { error: 'Could not parse token symbol' }; // Check treasury is not paused const globals = await getTableRows(rpcEndpoint, { code: XMD_TREASURY, scope: XMD_TREASURY, table: 'xmdglobals', limit: 1, }); if (globals.length > 0 && globals[0].isPaused) { return { error: 'XMD treasury is currently paused' }; } const quantity = formatAsset(amount, parsed.precision, parsed.symbol); const { api: eosApi, account, permission } = await getXmdSession(); const result = await eosApi.transact({ actions: [{ account: parsed.contract, name: 'transfer', authorization: [{ actor: account, permission }], data: { from: account, to: XMD_TREASURY, quantity, memo: 'mint', }, }], }, { blocksBehind: 3, expireSeconds: 30 }); ``` The redeem path has the same weakness: ```ts // Validate the target collateral exists and redeem is enabled const tokens = await getTableRows(rpcEndpoint, { code: XMD_TREASURY, scope: XMD_TREASURY, table: 'tokens', limit: 50, }); const token = tokens.find((t: any) => { ...[truncated 3823 chars]- Remediation
View remediation