CVE-2020-11014 (published 2020-04-28T20:15Z)

Electron-Cash-SLP before version 3.6.2 has a vulnerability. All token creators that use the "Mint Tool" feature of the Electron Cash SLP Edition are at risk of sending the minting authority baton to the wrong SLP address. Sending the mint baton to the wrong address will give another party the ability to issue new tokens or permanently destroy future minting capability. This is fixed version 3.6.2.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v3 base score: 8.6, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/simpleledger/Electron-Cash-SLP
commit_details: repo_url: https://github.com/simpleledger/Electron-Cash-SLP
author: James Cramer
author_date: 2020-04-24 14:57:51-04:00
msg: patch for critical vulnerability in mint tool
related to #126

This commit fixes an issue where the order of SLP outputs could be reordered because the "mandatory_coins" parameter was not being used as it should be with all SLP transactions.  Reordering the output addresses could sometimes cause the token mint baton receiver and token receiver addresses to be switched.
repository: repo_url: https://github.com/simpleledger/Electron-Cash-SLP
repo_name: simpleledger/Electron-Cash-SLP
description: Electron Cash for SLP Tokens
repo_language: Python
owner: simpleledger
file_changes: filename: slp_create_token_mint_dialog.py
change_type: ModificationType.MODIFY
diff: @@ -209,7 +209,7 @@ class SlpCreateTokenMintDialog(QDialog, MessageBoxMixin, PrintError):
 
         desired_fee_rate = 1.0  # sats/B, just init this value for paranoia
         try:
-            tx = self.main_window.wallet.make_unsigned_transaction(coins, outputs, self.main_window.config, fee, None)
+            tx = self.main_window.wallet.make_unsigned_transaction(coins, outputs, self.main_window.config, fee, None, mandatory_coins=[baton_input])
             desired_fee_rate = tx.get_fee() / tx.estimated_size()  # remember the fee coin chooser & wallet gave us as a fee rate so we may use it below after adding baton to adjust fee downward to this rate.
         except NotEnoughFunds:
             self.show_message(_("Insufficient funds"))
@@ -222,16 +222,6 @@ class SlpCreateTokenMintDialog(QDialog, MessageBoxMixin, PrintError):
             self.show_message(str(e))
             return
 
-        # Find & Add baton to tx inputs
-        try:
-            baton_utxo = self.main_window.wallet.get_slp_token_baton(self.token_id_e.text())
-        except SlpNoMintingBatonFound:
-            self.show_message(_("There is no minting baton found for this token."))
-            return
-
-        tx.add_inputs([baton_utxo])
-        for txin in tx._inputs:
-            self.main_window.wallet.add_input_info(txin)
 
         def tx_adjust_change_amount_based_on_baton_amount(tx, desired_fee_rate):
             ''' adjust change amount (based on amount added from baton) '''

programming_language: Python