CVE-2020-15130 (JSON, published 2020-07-30T15:15Z)
Description: value: In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 0.27.4.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-697 \u2014 Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Repository: https://github.com/simpleledger/slpjs
Files changed:
lib/localvalidator.ts
package-lock.json
package.json
Commit message: critical update for NFT child genesis validation


Vulnerable code:
                let input_txid = txn.inputs[0].prevTxId.toString("hex");
                let input_txhex = await this.retrieveRawTransaction(input_txid);
                let input_tx: Bitcore.Transaction = new Bitcore.Transaction(input_txhex);
                if (input_slpmsg.transactionType === SlpTransactionType.SEND &&
                    (!input_slpmsg.sendOutputs![1].isGreaterThan(0)))
                {
                    this.cachedValidations[txid].validity = false;
                    this.cachedValidations[txid].waiting = false;
                    this.cachedValidations[txid].invalidReason = "NFT1 child's parent has SLP output that is not greater than zero.";
                    return this.cachedValidations[txid].validity!;
                } else if ((input_slpmsg.transactionType === SlpTransactionType.GENESIS ||
                            input_slpmsg.transactionType === SlpTransactionType.MINT) &&
                            !input_slpmsg.genesisOrMintQuantity!.isGreaterThan(0))
                {
                    this.cachedValidations[txid].validity = false;
                    this.cachedValidations[txid].waiting = false;
                    this.cachedValidations[txid].invalidReason = "NFT1 child's parent has SLP output that is not greater than zero.";
                    return this.cachedValidations[txid].validity!;
      "version": "git+https://github.com/simpleledger/slp-unit-test-data.git#a450146e112aee4db5a1b33dc978229fdcfb23a4",
      "from": "git+https://github.com/simpleledger/slp-unit-test-data.git#a450146e112aee4db5a1b33dc978229fdcfb23a4",
    "slp-unit-test-data": "git+https://github.com/simpleledger/slp-unit-test-data.git#a450146e112aee4db5a1b33dc978229fdcfb23a4",

Fixed code:
                const input_txid = txn.inputs[0].prevTxId.toString("hex");
                const input_prevout = txn.inputs[0].outputIndex;
                const input_txhex = await this.retrieveRawTransaction(input_txid);
                const input_tx: Bitcore.Transaction = new Bitcore.Transaction(input_txhex);
                if (input_slpmsg.transactionType === SlpTransactionType.SEND) {
                    if (input_prevout > input_slpmsg.sendOutputs!.length - 1) {
                        this.cachedValidations[txid].validity = false;
                        this.cachedValidations[txid].waiting = false;
                        this.cachedValidations[txid].invalidReason = "NFT1 child GENESIS does not have a valid NFT1 parent input.";
                        return this.cachedValidations[txid].validity!;
                    } else if (! input_slpmsg.sendOutputs![input_prevout].isGreaterThan(0)) {
                        this.cachedValidations[txid].validity = false;
                        this.cachedValidations[txid].waiting = false;
                        this.cachedValidations[txid].invalidReason = "NFT1 child's parent has SLP output that is not greater than zero.";
                        return this.cachedValidations[txid].validity!;
                    } else {
                        this.cachedValidations[txid].validity = true;
                        this.cachedValidations[txid].waiting = false;
                    }
                } else if (input_slpmsg.transactionType === SlpTransactionType.GENESIS ||
                            input_slpmsg.transactionType === SlpTransactionType.MINT) {
                    if (input_prevout !== 1) {
                        this.cachedValidations[txid].validity = false;
                        this.cachedValidations[txid].waiting = false;
                        this.cachedValidations[txid].invalidReason = "NFT1 child GENESIS does not have a valid NFT1 parent input.";
                        return this.cachedValidations[txid].validity!;
                    } else if (!input_slpmsg.genesisOrMintQuantity!.isGreaterThan(0)) {
                        this.cachedValidations[txid].validity = false;
                        this.cachedValidations[txid].waiting = false;
                        this.cachedValidations[txid].invalidReason = "NFT1 child's parent has SLP output that is not greater than zero.";
                        return this.cachedValidations[txid].validity!;
                    }
      "version": "git+https://github.com/simpleledger/slp-unit-test-data.git#8c942eacfae12686dcf1f3366321445a4fba73e7",
      "from": "git+https://github.com/simpleledger/slp-unit-test-data.git#8c942eacfae12686dcf1f3366321445a4fba73e7",
    "slp-unit-test-data": "git+https://github.com/simpleledger/slp-unit-test-data.git#8c942eacfae12686dcf1f3366321445a4fba73e7",