PT-2022-23023 · Solana · Solana Pay
Cmowenby
+1
·
Published
2022-08-01
·
Updated
2023-05-16
·
CVE-2022-35917
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Solana Pay versions prior to 0.2.1
Description
Solana Pay is a protocol that enables developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient, using the supplied
validateTransfer function. An edge case regarding this mechanism could cause the validation logic to validate multiple transfers. Most known Solana Pay point of sale applications are currently run on physical point of sale devices, which makes this issue unlikely to occur. However, there may be web-based point of sale applications using the protocol where it may be more likely to occur.Recommendations
For versions prior to 0.2.1, upgrade to version 0.2.1 to resolve the issue. As a temporary workaround, consider restricting the use of the
validateTransfer function until the patch is applied. There are no known workarounds for this issue other than upgrading to the patched version.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Solana Pay