web3: Account may be created from invalid ed25519 secret keys

solana-labs / solana

Web-Scale Blockchain for fast, secure, scalable, decentralized apps and marketplaces.

https://solanalabs.com

Apache License 2.0

12.95k stars 4.16k forks source link

web3: Account may be created from invalid ed25519 secret keys #15074

Closed jstarry closed 3 years ago

jstarry commented 3 years ago

Problem

The TweetNaCl.js library doesn't validate secret keys used to create keypairs. This means that a keypair could be created which doesn't produce valid signatures.

Proposed Solution

Validate keypairs during Account construction to prevent issues with signing

jstarry commented 3 years ago

Dupe of https://github.com/solana-labs/solana/issues/16628