False-negative validation results in MINT transactions with invalid baton

CAO 8.6CVE-2020-11072 · GHSA-4w97-57v2-3w44 · Công bố 12/05/2020 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-11072 là lỗ hổng mức CAO (CVSS 8.6) ảnh hưởng slp-validate (simpleledger), slp-validate.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.0%, cao hơn 64.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.2.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
slp-validate simpleledger	`< 1.2.1`	`1.2.1`
slp-validate npm	`< 1.2.1`	`1.2.1`

Mô tả

Impact

Users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton.

Patches

npm package slp-validate has been patched and published as version 1.2.1.

Workarounds

Upgrade to slp-validate 1.2.1.

References

slp-validate commit

For more information

If you have any questions or comments about this advisory:

Open an issue in slp-validate

Mô tả của NVD

In SLP Validate (npm package slp-validate) before version 1.2.1, users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This has been fixed in slp-validate in version 1.2.1. Additonally, slpjs version 0.27.2 has a related fix under related CVE-2020-11071.