Tron2steem Bug Fix: Filter out TRC-10 Tokens
Critical Bug Identified:
The transaction processing logic for Tron2STEEM Swap did not filter out TRC-10 token transfers, which was a severe oversight. In theory, this vulnerability could be exploited to trigger unintended swaps, leading to significant financial losses.
Impact:
- Exploitation Risk: Malicious users could craft transactions with TRC-10 tokens (other than TRX) to mimic legitimate swap requests, draining the system's resources.
- Incorrect Transaction Handling: Non-TRX token transfers were being processed incorrectly, potentially polluting the database with invalid records.
- Financial Losses: Triggering swaps on TRC-10 tokens might result in losses due to unintended conversions or incorrect exchange rate calculations.
Fix Summary:
To mitigate this issue, a strict filter has been added to process only TRX or USDT, USDD transactions by verifying the transaction's contract type.
for (let tx of currentPageTransactions) {
// Check if the transaction is a TRX transfer (TransferContract)
const contractType = tx.raw_data.contract[0].type;
if (contractType !== "TransferContract") {
console.log(`Skipping non-TRX transaction: ${contractType}`);
continue;
}
// the rest of the code
Key Changes in Code:
- Added Contract Type Validation: Ensures only transactions with TransferContract (TRX transfers) are processed. Transactions involving TransferAssetContract (TRC-10 tokens) are now skipped.
- Improved Logging: Logs are updated to highlight when non-TRX transactions are filtered out for traceability.
Steem to the Moon🚀!
- You can rent Steem Power via rentsp!
- You can swap the TRON:TRX/USDT/USDD to STEEM via tron2steem!
- You can swap the STEEM/SBD to SOL Solana via steem2sol!
- You can swap the STEEM/SBD to ETH Ethereum via steem2eth!
- You can swap the STEEM/SBD to Tether USDT (TRC-20) via steem2usdt!
- You can swap the STEEM/SBD to TRX (TRON) via steem2trx!
- You can swap the STEEM/SBD to BTS (BitShares) via steem2bts!
- Register a free STEEM account at SteemYY!
- Steem Block Explorer
- ChatGPT/Steem Integration: You can type !ask command to invoke ChatGPT
- Steem Witness Table and API
- Other Steem Tools
Wow ...
@justyy Today(Dec 24), I've not received upvoting yet. Would you check it?
https://steemit.com/hive-103599/@happycapital/so-did-wall-street-sell-a-large-amount-of-eth
Sure, voted you on latest: https://steemit.com/workouts/@happycapital/7gcpxg-i-worked-out-for-an-hour
0.00 SBD,
0.07 STEEM,
0.07 SP
🤖 @justyy - wonderful content as always! 🌈 🚀
Hey friend! 🎉 Come check out your awesome post on my shiny new front-end! It's still a work in progress but I'd love to hear what you think! View your post here ✨