nebPay.js icon indicating copy to clipboard operation
nebPay.js copied to clipboard

Published 20 hours ago • verified publisher icon nebulasio

nebPay转账金额小数位超越边界后溢出

Open dabdevelop opened this issue 6 years ago • 5 comments

screen shot 2018-06-04 at 15 49 20 screen shot 2018-06-04 at 15 49 38

钱包显示的转账金额是0.03333....但是实际上却是超大额的转账，存在风险。

dabdevelop avatar Jun 04 '18 08:06 dabdevelop

screen shot 2018-06-04 at 16 45 44 如果把转账金额是填为0.00000000000000000022，那么可以作为有效的诱骗攻击，导致用户转账26w+NAS，存在巨大的风险。

dabdevelop avatar Jun 04 '18 08:06 dabdevelop

如果把转账金额是填为0.000000000000000000022，将导致用户转账24178 NAS，对大户造成很大的威胁。

dabdevelop avatar Jun 04 '18 08:06 dabdevelop

@dabdevelop Very helpful information, we will fix it today

ChengOrangeJu avatar Jun 04 '18 09:06 ChengOrangeJu

高危漏洞，奖励奖励！

jnoodle avatar Jun 04 '18 09:06 jnoodle

The minimum unit of value should be wei (1nas = 1^18 wei). We will throw an error when the minimum value of wei is not an integer now :) Thanks for pointing it out

ChengOrangeJu avatar Jun 04 '18 12:06 ChengOrangeJu