npm/@keep-network/tbtc-v2: high
SPV Merkle proof malleability allows the maintainer to prove invalid transactions
Action: Upgrade @keep-network/tbtc-v2 to 1.5.2 or later.
npm i @keep-network/tbtc-v2@1.5.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.5.2 | - |
Fixed versions
| 1.5.2 |
Sources
- osv: GHSA-wg2x-rv86-mmpx
- https://github.com/keep-network/tbtc-v2/security/advisories/GHSA-wg2x-rv86-mmpx
- https://github.com/summa-tx/bitcoin-spv/issues/192
- https://github.com/keep-network/tbtc-v2/commit/20a6fb1bfb23d4a3d5b90e00eaa7cc2abc9a2871
- https://bitslog.com/2018/06/09/leaf-node-weakness-in-bitcoin-merkle-tree-design
- https://github.com/keep-network/tbtc-v2
- https://leastauthority.com/static/publications/LeastAuthority_KeepNetwork_tBTC_Bridge_v2_Updated_Final_Audit_Report.pdf
- https://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20190225/a27d8837/attachment-0001.pdf
published · modified · JSON