Lisk-mobile: Inconsistent validation of the amount field in “Send token” functionality of lisk-mobile #1921
Comments
6 tasks
97 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
The lisk-mobile “Send token” feature consists of two screens. In the first one a user provides values like amount to send and recipient address. The second one displays all the provided data for confirmation. An adversary may perform a phishing attack by providing values that are different when shown on a phone screen and when used by the code. One of the discoveried attack vectors is related to the “Amount” field. That field is expected to contain a number with optional decimal separator. However, any data is accepted by the code.
Actual behavior
A partial validation of the “Amount” is done in the useSendTokenAmountChecker method. There, the amount variable holds a user-provided string. The isTransactionAmountValid method checks the format of the string. If the amount is in invalid format, the code will set the validatedAmount variable to 0, and so the isMaxAllowedAmountExceeded variable is set to true.
lisk-mobile/src/modules/SendToken/hooks/useSendTokenAmountChecker.js
Lines 32 to 43 in 52ac8a1
Recommendations
Short term, improve validation of the “Amount” field to be more strict. Make sure that the user is always presented with the exact value that is used by the code.
Long term, perform root cause analysis of the issue and review similar attack vectors.
The text was updated successfully, but these errors were encountered: