#6589 · C++ · ★ 5.2k · ISC · updated 3mo ago
Summary The book_offers RPC handler validates the domain parameter for hex format but does not check whether the domain actually exists in the ledger. This results in misleading behavior where a query with a non-existent domain returns an empty result set instead of a clear…
#6661 · C++ · ★ 5.2k · ISC · updated 3mo ago
Issue Description In ammAssetOut (src/libxrpl/tx/transactors/dex/AMMHelpers.cpp, lines 120–131), the denominator (t1 * f - 1) is used without an explicit assertion: auto const frac = (t1 * t1 - t1 * (2 - f)) / (t1 * f - 1); Where t1 = lpTokens / lptAMMBalance and f =…
#6763 · C++ · ★ 5.2k · ISC · updated 3mo ago
Missing type validation for secret in validation_create Severity: LOW In ValidationCreate.cpp, the validationSeed() function calls params[jss::secret].asString() (line 16) without first checking that the secret field is actually a string. If a non-string JSON type is provided…
#6741 · C++ · ★ 5.2k · ISC · updated 4mo ago
blacklist: missing type check on 'threshold' parameter causes unhelpful rpcINTERNAL error Severity: LOW In doBlackList, context.params[jss::threshold].asInt() is called at line 15 without verifying the field's type. If 'threshold' is a JSON object or array, jsoncpp's asInt()…