You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In btc-staking-ts, there are multiple functions that claim to validate whether values are negative but do so incorrectly.
In addition, the ObservableStaking class does not validate whether the btcActivationHeight field is a negative number.
A user or dApp would not be prevented from accidentally supplying a negative number for these fields, which could lead to unintended behavior.
In the case of StakingScripts, this value would be compiled into the Bitcoin script and passed to the OP_CHECKSEQUENCEVERIFY opcode, which could lead to errors upon execution.
Recommendations
Fix the checks to prevent negative values.
Examples
// check that maximum value for staking time is not greater than uint16 and
above 0
if (this.stakingTimeLock == 0 || this.stakingTimeLock > 65535) {
return false;
}
// check that maximum value for unbonding time is not greater than uint16 and
above 0
if (this.unbondingTimeLock == 0 || this.unbondingTimeLock > 65535) {
return false;
}
The text was updated successfully, but these errors were encountered:
In btc-staking-ts, there are multiple functions that claim to validate whether values are negative but do so incorrectly.
In addition, the ObservableStaking class does not validate whether the btcActivationHeight field is a negative number.
A user or dApp would not be prevented from accidentally supplying a negative number for these fields, which could lead to unintended behavior.
In the case of StakingScripts, this value would be compiled into the Bitcoin script and passed to the OP_CHECKSEQUENCEVERIFY opcode, which could lead to errors upon execution.
Recommendations
Fix the checks to prevent negative values.
Examples
The text was updated successfully, but these errors were encountered: