Script.tv Wallet

CertiK15 Dec 2023Not recorded. See the report

CertiK reviewed Script Network (Script.tv Wallet) on 15 Dec 2023: 5 findings, 1 critical; 4 marked fixed, 1 acknowledged.

1 critical finding, fixed

Open the report Open Script Network’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	1
High	0	0
Medium	0	2
Low	1	1

CriticalThe wallet keystore file is sent to the server duFixed

The application's wallet creation feature is designed to generate a new crypto wallet for users. A security issue has been identified wherein the wallet key file is uploaded to the server during the wallet creation process.

MediumInsecure Hash Function Implementation and MisleadFixed

The `CryptoService.js` file is contained within the "script-tv wallet" codebase to perform cryptographic operations. Specifically, two functions are outlined: `getHash` which computes an MD5 hash of the input text, and `encryptHmacSHA256` which generates an HMAC-SHA512 hash of the input text using a hardcoded secret.

MediumWeak Password PolicyFixed

An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. A lack of password complexity significantly reduces the search space when trying to guess a user's password, making brute-force attacks easier. The currently implemented password policy is permissive regarding the password length and complexity requirements, as it allows passwords to contain only 1 character.

LowVerbose Error Message Exposure from Server-Side AFixed

During the security assessment, it was observed that the script-tv wallet application communicates with server-side APIs for various functions. Some of these server APIs, when encountering an error, respond with explicit error messages.