Skip to content

Commit fcbb68f

Browse files
committed
fix(sdk-coin-stx): verify recipient and amount in native STX verifyTransaction
Previously, Stx.verifyTransaction was a near no-op: it only checked that the recipient count was <= 1. A compromised prebuild could redirect native STX sends to any address or alter the amount, and local verification would still pass. Port the full decode-and-compare pattern from Sip10Token.verifyTransaction into Stx.verifyTransaction. The new implementation: - Decodes the prebuild txHex via explainTransaction - Compares the decoded recipient address (stripping memoId) and amount against txParams.recipients[0] - Compares the memo (from txParams.memo or embedded in the recipient address) against the decoded transaction memo - Validates that the total output amount matches the declared total This closes the gap where the SIP10 token path already had full recipient validation but native STX did not, matching the pattern described in CSHLD-839. Ticket: CSHLD-839 Session-Id: 7de30368-fc1b-4b09-9d2e-55be78e462dc Task-Id: 2203e736-35f2-4e2f-8cde-6cdbd0d3e2b6
1 parent 363af06 commit fcbb68f

3 files changed

Lines changed: 161 additions & 245 deletions

File tree

0 commit comments

Comments
 (0)