{"id":"GHSA-xfrc-7mj2-5xh9","aliases":[],"status":"published","title":"Undefined Behavior in zencashjs","description":"Versions of `zencashjs` prior to 1.2.0 may cause loss of funds when used with cryptocurrency wallets. The package relies on a string comparison of the first two characters of a Horizen address to determine the destination address type of a transaction (P2PKH or P2SH). Due to the base58 address prefixes chosen in Horizen there exists the possibility of a clash of address prefixes for testnet P2PKH and mainnet P2SH addresses, testnet P2PKH addresses start with “zt” while a subset of mainnet P2SH addresses can also start with “zt”. The package interprets transactions sent to a “zt” P2SH address on mainnet as P2PKH transactions erroneously. Any funds sent to a mainnet P2SH multisignature address starting with “zt” will be sent to the wrong address and be lost.\n\n\n## Recommendation\n\nUpgrade to version 1.2.0 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2020-09-03T17:14:51Z","modified":"2023-01-09T05:04:08Z","fixes":[{"ecosystem":"npm","package":"zencashjs","fixed_in":["1.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"zencashjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}]},{"source":"osv","ecosystem":"npm","package":"zencashjs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}]}],"references":[{"url":"https://github.com/ZencashOfficial/zencashjs/commit/db01bd94b9f8a956d7835e934500eaa643f8bd13#diff-42d8d2088a96641b563b25ad908b0c0fR146","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1035","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xfrc-7mj2-5xh9"}],"sources":{"ghsa":[{"id":"GHSA-xfrc-7mj2-5xh9","title":"Undefined Behavior in zencashjs","description":"Versions of `zencashjs` prior to 1.2.0 may cause loss of funds when used with cryptocurrency wallets. The package relies on a string comparison of the first two characters of a Horizen address to determine the destination address type of a transaction (P2PKH or P2SH). Due to the base58 address prefixes chosen in Horizen there exists the possibility of a clash of address prefixes for testnet P2PKH and mainnet P2SH addresses, testnet P2PKH addresses start with “zt” while a subset of mainnet P2SH addresses can also start with “zt”. The package interprets transactions sent to a “zt” P2SH address on mainnet as P2PKH transactions erroneously. Any funds sent to a mainnet P2SH multisignature address starting with “zt” will be sent to the wrong address and be lost.\n\n\n## Recommendation\n\nUpgrade to version 1.2.0 or later.","status":"published","published":"2020-09-03T17:14:51Z","modified":"2023-01-09T05:04:08Z","updated_at":"2026-11-02T14:36:08.863482Z"}],"osv":[{"id":"GHSA-xfrc-7mj2-5xh9","title":"Undefined Behavior in zencashjs","description":"Versions of `zencashjs` prior to 1.2.0 may cause loss of funds when used with cryptocurrency wallets. The package relies on a string comparison of the first two characters of a Horizen address to determine the destination address type of a transaction (P2PKH or P2SH). Due to the base58 address prefixes chosen in Horizen there exists the possibility of a clash of address prefixes for testnet P2PKH and mainnet P2SH addresses, testnet P2PKH addresses start with “zt” while a subset of mainnet P2SH addresses can also start with “zt”. The package interprets transactions sent to a “zt” P2SH address on mainnet as P2PKH transactions erroneously. Any funds sent to a mainnet P2SH multisignature address starting with “zt” will be sent to the wrong address and be lost.\n\n\n## Recommendation\n\nUpgrade to version 1.2.0 or later.","status":"published","published":"2020-09-03T17:14:51Z","modified":"2020-08-31T18:44:53Z","updated_at":"2026-11-02T15:46:59.835583Z"}]}}