search

gatewaycash / gateway

Gateway - Simple Bitcoin Payments
GNU Affero General Public License v3.0
18 stars 10 forks source link

The dangers of invoiceAmount #114

Open ty-everett opened 5 years ago

ty-everett commented 5 years ago

The invoiceAmount is dangerous because this is provided by the user's browser. Merchants cannot depend on this information. Malicious user can set invoiceAmount to be really small, and if the merchant uses it for verification they will ship the item.