Shentu - MultiSig

Repository: - multisig-service File: - util/token.go The web application uses JSON Web Tokens (JWT) for authentication. Once a token has been signed by the `CreateToken function`, it remains valid for 1 month (720 hours). ```go=16 func CreateToken(hexAddr string) (string, error) { expTime := time.Now().Add(time.Hour * 720).Unix() claims := CustomClaims{ HexAddr: hexAddr, StandardClaims: jwt.StandardClaims{ ExpiresAt: expTime, }, } token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims) tokenString, err := token.SignedString(signingTokenKey) return tokenString, err } ``` While this extended validity period offers convenience by minimizing the need for frequent logins, it also introduces significant security risks. If a token is compromised (e.g., through theft or interception), the long expiration period increases the window of opportunity for malicious actors to misuse the token, potentially leading to unauthorized access to sensitive data or user accounts.

Repository: - multisig-service File: - util/sign.go The function `VerifyADR036Sign` is potentially vulnerable to replay attacks. This vulnerability arises because the current implementation does not include mechanisms to ensure the uniqueness of each signed message. Without unique identifiers like nonce or context-specific information, an attacker could intercept a valid signed message, possibly through network sniffing or other unauthorized access methods, and resend it to gain access to the system. This could allow an attacker to obtain and reuse someone else's JWT token, enabling unauthorized access to other system functionalities. ```go=30 func VerifyADR036Sign(address, pubKey, signature, message string) bool { message = fmt.Sprintf(`{"message":"%s"}`, message) base64Msg := base64.StdEncoding.EncodeToString([]byte(message)) signMsg := fmt.Sprintf(`{"chain_id":"","account_number":"0","sequence":"0","fee":{"gas":"0","amount":[]},"msgs":[{"type":"sign/MsgSignData","value":{"signer":"%s","data":"%s"}}],"memo":""}`, address, base64Msg) sortMsg := sdk.MustSortJSON([]byte(signMsg)) // verify signature pubKeyBytes, err := base64.StdEncoding.DecodeString(pubKey) if err != nil { return false } sigBytes, err := base64.StdEncoding.DecodeString(signature) if err != nil { return false } return VerifySignature(pubKeyBytes, sigBytes, sortMsg) } ``` Replay attacks can lead to unauthorized access, allowing attackers to perform actions on behalf of legitimate users. This includes accessing sensitive data, executing transactions, or utilizing system resources, thereby compromising the security and integrity of the system.

Repository: - multisig-service Files: - controller/account.go - router/loader.go The function `MemAccountRename` is defined to rename a multisig account for a given user based on the provided JSON request data. **router/loader.go** ```go=44 func addMultisigEndpoints(g *gin.Engine) { multisig := g.Group("api/v1/multisig") multisig.GET("chains", controller.GetAllChainInfo) multisig.POST("account", controller.CreateAccount) multisig.GET("accounts", controller.GetAccounts) multisig.PUT("account/active", controller.ActiveAccount) multisig.PUT("account/rename", controller.WalletAccountRename) // save multisig transaction multisig.POST("tx", controller.CreateTx) multisig.POST("tx/sign", controller.SaveTxSign) multisig.DELETE("tx", controller.DelTx) multisig.PUT("tx/hash", controller.UpdateTxInfo) multisig.GET("tx/pending", controller.GetPendingTxs) multisig.GET("tx/history", controller.GetHistoryTxs) } ``` However, it is not registered as an endpoint in the `addMultisigEndpoints` function, which means the functionality cannot be accessed through the API, rendering it ineffective.