T07 · Tool Hijacking and Spoofing
Error
- Location
src/dca-manager.js:50- Finding
Fabricated DCA Purchases and Transaction Records
- Content
View full analysis
Vulnerability Details
File Location:
src/dca-manager.js:50-159
Vulnerability Type: Transaction and tool-output spoofing
Risk Level: CriticalVulnerable Code:
js async fetchFromBinance(symbol) { // Mock implementation return 6.52; } async fetchFromCoinbase(symbol) { // Mock implementation return 6.48; } async executeSwap(accountId, privateKey, exchange, amountUSD) { const nearPrice = await this.getNearPrice(); const nearAmount = amountUSD / nearPrice; const exchangeInstance = this.exchanges[exchange]; if (!exchangeInstance) { throw new Error(`Unknown exchange: ${exchange}`); } const result = await exchangeInstance.swap({ accountId, privateKey, amountUSD, nearAmount, nearPrice }); return { txHash: result.txHash, nearAmount, nearPrice, usdSpent: amountUSD, timestamp: new Date().toISOString(), exchange }; }js class RefFinanceExchange { constructor(config) { this.poolId = 4; // NEAR/USDT pool on Ref Finance } async swap({ accountId, privateKey, nearAmount, nearPrice }) { // Implement Ref Finance swap logic // This would use near-api-js to interact with Ref Finance contract const txHash = crypto.randomBytes(32).toString('hex'); return { txHash, success: true, nearReceived: nearAmount * 0.997, slippage: 0.001 }; } } class JumboExchange { constructor(config) { this.routerAddress = 'token.jumbo_exchange.near'; } async swap({ accountId, privateKey, nearAmount, nearPrice }) { const txHash = crypto.randomBytes(32).toString('hex'); return { txHash, success: true, nearReceived: nearAmount * 0.997, slippage: 0.001 }; } } class BancorExchange { constructor(config) { this.poolId = 'near-usdt'; } async swa ...[truncated 2535 chars]- Remediation
View remediation
Remediation Suggestions
- Remove or disable all purchase actions and scheduled execution until genuine transaction support is implemented.
- If the code is intended as a simulator, rename actions and response fields to identify them explicitly as simulations.
- Use testnet-only defaults for development and prevent simulated transactions from being recorded as real purchases.
- Retrieve prices from authenticated or otherwise validated market-data providers, with timeouts and stale-price checks.
- Construct and sign transactions through a supported NEAR SDK.
- Submit transactions only to an explicitly configured network and validated contract allowlist.
- Record success only after obtaining and verifying a finalized on-chain receipt.
- Validate the receipt’s signer, receiver, method, token amounts, status, and network.
- Return simulation identifiers separately; never format random bytes as an on-chain transaction hash.
- Add tests that query transaction receipts and reject fabricated or unconfirmed hashes.