crypto-bug-hunters / bug-buster

🪲 Bug Buster, a bug bounty platform powered by Cartesi Rollups
https://x.com/BugBusterApp
Apache License 2.0
9 stars 8 forks source link

Bad key provided to `slog` #78

Closed guidanoli closed 2 months ago

guidanoli commented 2 months ago

In the back-end, we're using the slog Go package for logging purposes. When running the application, we sometimes see this kind of message:

validator-1  | DBG testing an exploit for %v
validator-1  |  !BADKEY=/bounties/1.tar.xz

It seems that the back-end is trying to do some string interpolation (with %v), but slog just prints the message as-is, and raises a "bad key" error with the value that should have been inserted in the original message.