T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/wallet_address_check.py:3
- Finding
- Invalid Cryptocurrency Addresses Can Be Incorrectly Reported as Passing Validation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wallet_address_check.py`, lines 3-30 **Vulnerability Type**: Incomplete cryptocurrency address and checksum validation **Risk Level**: High ### Vulnerable Code ```python B58 = re.compile(r"^[1-9A-HJ-NP-Za-km-z]{26,35}$") B32 = re.compile(r"^bc1[02-9ac-hj-np-z]{11,71}$") HEX = re.compile(r"^0x[0-9a-fA-F]{40}$") ``` ```python elif B32.match(addr): chains.append("Bitcoin(bech32/bc1)") ok = True elif B58.match(addr): if addr.startswith("T") and len(addr) == 34: chains.append("TRON(Base58)") else: chains.append("Bitcoin(Base58)等Base58系") ok = True notes.append("Base58地址未做双哈希校验和验证，大额转账请先小额试转") else: chains.append("无法识别") notes.append("格式不符合常见EVM/BTC系/TRON地址") ``` ### Technical Analysis The validator treats regular-expression conformance as sufficient for a successful result. It does not decode or validate: - Bitcoin Bech32 or Bech32m checksums. - Witness versions and their required Bech32/Bech32m encodings. - Witness program lengths. - Bitcoin network and address-version constraints. - Base58Check checksums or version bytes. - TRON Base58Check checksums and decoded network prefixes. Consequently, an address can use the permitted alphabet and length while containing a typographical error or deliberately invalid checksum. Such an address is assigned `ok = True`, printed as `PASS`, and returned with exit code `0`. The Base58 warning does not mitigate the vulnerability because the machine-readable result and process exit status still represent the address as valid. Automation invoking this script may rely exclusively on the Boolean result or exit code and never evaluate the warning. ### Attack Path 1. An attacker constructs or supplies a Bitcoin or TRON address-shaped string that satisfies the applicable regular expression but has an invalid checksum, version, or encoding. 2. A user or transfer workflow invokes the validator before making a payment. 3. ...[truncated 918 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Implement complete Bech32 and Bech32m decoding and checksum verification according to the relevant Bitcoin Improvement Proposals. 2. Validate witness versions, witness program lengths, human-readable network prefixes, and the required encoding variant. 3. Decode Base58 addresses and verify the complete Base58Check checksum before returning success. 4. Validate decoded version and network bytes separately for Bitcoin and TRON instead of inferring the chain from string shape alone. 5. Do not return `PASS` or exit status `0` when cryptographic validation was not performed. Introduce an explicit `INDETERMINATE` result with a nonzero exit status if full validation is unavailable. 6. Add positive and negative tests covering altered checksums, invalid version bytes, incorrect witness encodings, boundary lengths, and network mismatches. 7. Clearly distinguish syntactic screening from cryptographic address validation in both human-readable and JSON output. ]]>