CVE-2020-11014: Insufficient Information (NVD-CWE-noinfo)
value: Electron-Cash-SLP before version 3.6.2 has a vulnerability. All token creators that use the "Mint Tool" feature of the Electron Cash SLP Edition are at risk of sending the minting authority baton to the wrong SLP address. Sending the mint baton to the wrong address will give another party the ability to issue new tokens or permanently destroy future minting capability. This is fixed version 3.6.2.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.6
Published: 2020-04-28T20:15Z
Repository: https://github.com/simpleledger/Electron-Cash-SLP
Language: Python
Files changed: gui/qt/slp_create_token_mint_dialog.py
Commit date: 2020-04-24 14:57:51 -0400
Commit message: patch for critical vulnerability in mint tool
related to #126

This commit fixes an issue where the order of SLP outputs could be reordered because the "mandatory_coins" parameter was not being used as it should be with all SLP transactions.  Reordering the output addresses could sometimes cause the token mint baton receiver and token receiver addresses to be switched.

Diff: diff --git a/gui/qt/slp_create_token_mint_dialog.py b/gui/qt/slp_create_token_mint_dialog.py
index bf0a5d8d..6734f6f2 100644
--- a/gui/qt/slp_create_token_mint_dialog.py
+++ b/gui/qt/slp_create_token_mint_dialog.py
@@ -207,11 +207,11 @@ class SlpCreateTokenMintDialog(QDialog, MessageBoxMixin, PrintError):
             self.show_message(_("No baton exists for this token."))
             return
 
         desired_fee_rate = 1.0  # sats/B, just init this value for paranoia
         try:
-            tx = self.main_window.wallet.make_unsigned_transaction(coins, outputs, self.main_window.config, fee, None)
+            tx = self.main_window.wallet.make_unsigned_transaction(coins, outputs, self.main_window.config, fee, None, mandatory_coins=[baton_input])
             desired_fee_rate = tx.get_fee() / tx.estimated_size()  # remember the fee coin chooser & wallet gave us as a fee rate so we may use it below after adding baton to adjust fee downward to this rate.
         except NotEnoughFunds:
             self.show_message(_("Insufficient funds"))
             return
         except ExcessiveFee:
@@ -220,20 +220,10 @@ class SlpCreateTokenMintDialog(QDialog, MessageBoxMixin, PrintError):
         except BaseException as e:
             traceback.print_exc(file=sys.stdout)
             self.show_message(str(e))
             return
 
-        # Find & Add baton to tx inputs
-        try:
-            baton_utxo = self.main_window.wallet.get_slp_token_baton(self.token_id_e.text())
-        except SlpNoMintingBatonFound:
-            self.show_message(_("There is no minting baton found for this token."))
-            return
-
-        tx.add_inputs([baton_utxo])
-        for txin in tx._inputs:
-            self.main_window.wallet.add_input_info(txin)
 
         def tx_adjust_change_amount_based_on_baton_amount(tx, desired_fee_rate):
             ''' adjust change amount (based on amount added from baton) '''
             if len(tx._outputs) not in (3,4):
                 # no change, or a tx shape we don't know about

Vulnerable code:             tx = self.main_window.wallet.make_unsigned_transaction(coins, outputs, self.main_window.config, fee, None)
        # Find & Add baton to tx inputs
        try:
            baton_utxo = self.main_window.wallet.get_slp_token_baton(self.token_id_e.text())
        except SlpNoMintingBatonFound:
            self.show_message(_("There is no minting baton found for this token."))
            return

        tx.add_inputs([baton_utxo])
        for txin in tx._inputs:
            self.main_window.wallet.add_input_info(txin)
Fixed code:             tx = self.main_window.wallet.make_unsigned_transaction(coins, outputs, self.main_window.config, fee, None, mandatory_coins=[baton_input])