BSV Wallet Toolbox Packages Vulnerable to Output Script Substitution, Enabling Fund Redirection

What happened

Security researchers identified that transactions created through a remote `StorageClient` in the affected packages trust output locking scripts returned by the storage provider without verifying that they match the outputs originally requested by the caller. This means a storage provider that is malicious, or has been compromised, can substitute a different recipient script or inject an additional output into a transaction before it is signed. The wallet application and its user interface continue to display the originally intended recipient, so the substitution is not visible to the user at the time of signing or broadcasting.

Technical cause

The root cause is classified as Improper Validation of Consistency within Input (CWE-1288). When a wallet constructs a transaction via a remote `StorageClient`, the storage provider supplies output locking scripts as part of the transaction data. The affected code does not cross-check these storage-supplied scripts and values against the outputs the caller originally requested before the wallet signs the transaction. As a result, any discrepancy introduced by the storage provider passes through unchecked.

Why it matters

Because the substitution happens at the storage layer and is not reflected in the application's displayed recipient, a user or application has no visual indication that a transaction has been altered before signing. If exploited, this allows a malicious or compromised storage provider to redirect funds to an attacker-controlled destination instead of the intended recipient, undermining a core guarantee of wallet software: that what is shown to the user is what gets signed and broadcast.

Who is affected

Applications and services that use `@bsv/wallet-toolbox`, `@bsv/wallet-toolbox-client`, or `@bsv/wallet-toolbox-mobile` together with a remote `StorageClient` provider for transaction construction are affected. Applications relying solely on local storage for transaction construction are not described as vulnerable in the available facts.

Affected versions

`@bsv/wallet-toolbox` and `@bsv/wallet-toolbox-client`: versions from 1.1.47 up to but not including 2.4.0. `@bsv/wallet-toolbox-mobile`: versions from its initial release 1.3.21 up to but not including 2.4.0. Public source material also references version 2.3.3 as being within the affected range for all three packages.

Fixes and mitigation

All three packages are patched in version 2.4.0. Organizations that cannot upgrade immediately should avoid using remote `StorageClient` providers, switch to local storage for transaction construction, or independently verify every transaction output's locking script and value against the original request before the wallet signs it.

Recommended action

Upgrade `@bsv/wallet-toolbox`, `@bsv/wallet-toolbox-client`, and `@bsv/wallet-toolbox-mobile` to version 2.4.0 as soon as possible. If an immediate upgrade is not feasible, disable or replace remote `StorageClient` providers with local storage, or add independent verification of all transaction outputs before signing, as described in the advisory.