False-positive validity for NFT1 genesis transactions in SLPJS
Impact
In the npm package named "slpjs", versions prior to 0.27.4 are vulnerable to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification.
Patches
npm package "slpjs" has been patched and is published and tagged as version 0.27.4.
Workarounds
Upgrade to slpjs 0.27.4.
References
- Package location: https://www.npmjs.com/package/slpjs
- SLP NFT1 spec: https://slp.dev/specs/slp-nft-1/#nft1-protocol-requirements
- Git commit hash fixing this issue: https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c
- Unit tests have been added to assist validator implementations in avoiding this bug: https://github.com/simpleledger/slp-unit-test-data/commit/8c942eacfae12686dcf1f3366321445a4fba73e7
For more information
If you have any questions or comments about this advisory please open an issue in the slp-validate repository.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | slpjs | < 0.27.4 | 0.27.4 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-697- Platform
- npm
- Package
slpjs- Disclosed
- 30.07.2020
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-cc2p-4jhr-xhhx - CC BY 4.0
Vulnerability history: slpjs
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 11.2019 07.2020
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
Disclosures per year
- 2019: 1
- 2020: 2
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
False-positive validity for NFT1 genesis transactions in SLPJS this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.