CVE-2020-15131 (JSON, published 2020-07-30T15:15Z)
Description: value: In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 1.2.2.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-697 \u2014 Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Repository: https://github.com/simpleledger/slp-validate.js
Files changed:
lib/validation.ts
package-lock.json
Commit message: critical update for NFT child genesis validation


Vulnerable code:
                const inputTxid = txn.inputs[0].previousTxHash;
                const inputTxHex = await this.retrieveRawTransaction(inputTxid);
                const inputTx: Transaction = Transaction.parseFromBuffer(inputTxHex);
                    inputSlpMsg = Slp.parseSlpOutputScript(inputTx.outputs[0].scriptPubKey);
                if (inputSlpMsg.transactionType === SlpTransactionType.SEND &&
                    !inputSlpMsg.sendOutputs![1].gt(0)) {
                    validation.validity = false;
                    validation.waiting = false;
                    validation.invalidReason = "NFT1 child's parent has SLP output that is not greater than zero.";
                    return validation.validity!;
                } else if ((inputSlpMsg.transactionType === SlpTransactionType.GENESIS ||
                            inputSlpMsg.transactionType === SlpTransactionType.MINT) &&
                            !inputSlpMsg.genesisOrMintQuantity!.gt(0)) {
                    validation.validity = false;
                    validation.waiting = false;
                    validation.invalidReason = "NFT1 child's parent has SLP output that is not greater than zero.";
                    return validation.validity!;
                    txid: inputTxid,
      "version": "git+https://github.com/simpleledger/slp-unit-test-data.git#be74a6005dbf7dfabce19a9f920b2632b539f73e",

Fixed code:
                const inputPrevTxid = txn.inputs[0].previousTxHash;
                const inputPrevOut = txn.inputs[0].previousTxOutIndex;
                const inputPrevTxHex = await this.retrieveRawTransaction(inputPrevTxid);
                const inputPrevTx: Transaction = Transaction.parseFromBuffer(inputPrevTxHex);
                    inputSlpMsg = Slp.parseSlpOutputScript(inputPrevTx.outputs[0].scriptPubKey);
                if (inputSlpMsg.transactionType === SlpTransactionType.SEND) {
                    if (inputPrevOut > inputSlpMsg.sendOutputs!.length - 1) {
                        validation.validity = false;
                        validation.waiting = false;
                        validation.invalidReason = "NFT1 child GENESIS does not have a valid NFT1 parent input.";
                        return validation.validity!;
                    }
                    if (! inputSlpMsg.sendOutputs![inputPrevOut].gt(0)) {
                        validation.validity = false;
                        validation.waiting = false;
                        validation.invalidReason = "NFT1 child's parent has SLP output that is not greater than zero.";
                        return validation.validity!;
                    }
                } else if (inputSlpMsg.transactionType === SlpTransactionType.GENESIS ||
                            inputSlpMsg.transactionType === SlpTransactionType.MINT) {
                    if (inputPrevOut !== 1) {
                        validation.validity = false;
                        validation.waiting = false;
                        validation.invalidReason = "NFT1 child GENESIS does not have a valid NFT1 parent input.";
                        return validation.validity!;
                    }
                    if (!inputSlpMsg.genesisOrMintQuantity!.gt(0)) {
                        validation.validity = false;
                        validation.waiting = false;
                        validation.invalidReason = "NFT1 child's parent has SLP output that is not greater than zero.";
                        return validation.validity!;
                    }

                    txid: inputPrevTxid,
      "version": "git+https://github.com/simpleledger/slp-unit-test-data.git#8c942eacfae12686dcf1f3366321445a4fba73e7",