T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/chaoschain_skill.py:568
- Finding
- Mainnet Registration Is Incorrectly Presented as a Testnet Transaction<![CDATA[ ## Vulnerability Details **File Location**: `scripts/chaoschain_skill.py:185-188` and `scripts/chaoschain_skill.py:568-579` **Vulnerability Type**: Incorrect network classification and missing transaction confirmation **Risk Level**: High ### Vulnerable Code ```python NETWORK_ALIASES = { "mainnet": "ethereum_mainnet", "sepolia": "ethereum_sepolia", } ``` ```python # Extra warning for mainnet if config["network"] == "mainnet": print("🔴 MAINNET TRANSACTION - REAL ETH REQUIRED") print("") print("You are about to register on Ethereum Mainnet.") print("This costs real ETH and is permanent.") print("") print("For testing, use: /chaoschain register --network sepolia") print("") else: print(f"Network: {config['network'].upper()} (testnet)") print("") ``` ### Technical Analysis Network aliases are normalized before registration. The `mainnet` alias becomes `ethereum_mainnet`, but the warning condition subsequently compares the normalized value against the unreachable string `mainnet`. Consequently, `config["network"] == "mainnet"` is false for Ethereum mainnet. It is also false for every other supported mainnet identifier, such as `base_mainnet` and `polygon_mainnet`. These networks therefore enter the `else` branch and are explicitly labeled as testnets. The registration flow does not request an interactive confirmation after displaying this incorrect classification. If a private key and sufficient funds are configured, the Skill proceeds to build, locally sign, and broadcast the transaction. ### Attack Path 1. A user configures `CHAOSCHAIN_NETWORK=mainnet` or invokes: ```bash /chaoschain register --network mainnet ``` 2. The alias parser normalizes `mainnet` to `ethereum_mainnet`. 3. The registration warning checks whether `config["network"]` equals `mainnet`. 4. The condition fails because the value is `ethereum_mainnet`. 5. The Skill displays `ETHEREUM_MAINNET (testnet)` instead of the real-fun ...[truncated 808 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Represent network type explicitly in each network configuration: ```python "ethereum_mainnet": { ... "is_mainnet": True, } ``` Then use: ```python if config["is_mainnet"]: ... ``` 2. Alternatively, classify normalized identifiers consistently: ```python is_mainnet = config["network"].endswith("_mainnet") ``` An explicit configuration field is preferable because it avoids reliance on naming conventions. 3. Require affirmative confirmation before broadcasting any registration transaction. For noninteractive use, require an explicit flag such as `--yes`, and require an additional mainnet-specific acknowledgement such as: ```bash --confirm-mainnet ``` 4. Display the chain ID, RPC host, registry address, estimated maximum gas cost, and wallet address before requesting confirmation. 5. Treat every non-testnet network as production rather than placing unknown networks in a generic testnet branch. 6. Add automated tests for aliases and every supported network, verifying that all `*_mainnet` networks receive a real-funds warning and all testnets receive the correct label. ]]>