Zcash × Brave WalletPersonal project
Search/ Updated
Menu

Type to search. Use ↑ ↓ and Enter to open a result.

[ZCash] Missing tx_hash length validation before RPC call

Open Bug Security & hardening

Lead item brave-browser#52029 · opened by kdenhartog · last source update

This issue is open on GitHub. Fixes sometimes land through pull requests that do not link the issue (for example a later refactor); this tracker follows only explicit links (closing references, “Resolves” lines, brave_<issue> branch names, uplifts and the issue timeline).

Issue state

Open

Open.

Implementation

No pull request is linked by closing keywords, GitHub’s closing references, a brave_<issue> branch name or the issue timeline.

Release notes

No platform changelog lists this item.

Validation

No QA label.

No QA pass labels.

QA labels are Brave’s own validation records per OS. They are not independent verification by this tracker.

Target

No milestone set.

Platforms (OS labels): none

Owner: cypt4

Build presence

Whether a merged pull request in this group is an ancestor of the brave-core tag of each platform’s current build (from versions.brave.com). Code presence is not the same as a feature being exposed on that platform.

PlatformReleaseBetaNightly
DesktopUnknown 1.97.59no merged PR is linked, so presence in this build is unknownUnknown 1.98.47no merged PR is linked, so presence in this build is unknownUnknown 1.100.5no merged PR is linked, so presence in this build is unknown
AndroidUnknown 1.97.57no merged PR is linked, so presence in this build is unknownUnknown 1.98.52no merged PR is linked, so presence in this build is unknownUnknown 1.100.5no merged PR is linked, so presence in this build is unknown
iOSUnknown 1.96.62no merged PR is linked, so presence in this build is unknownUnknown 1.99.44no merged PR is linked, so presence in this build is unknownUnknown 1.100.7no merged PR is linked, so presence in this build is unknown

Members and their history

Issue

brave-browser#52029 [ZCash] Missing tx_hash length validation before RPC call

State: open · created · updated · discovered via label:feature/web3/wallet/zcash, search:zcash · matched label:feature/web3/wallet/zcash, title:zcash, body:zcash_rpc

bug priority/P4 feature/web3/wallet feature/web3/wallet/core feature/web3/wallet/zcash

Location: zcash_rpc.cc:308-315 (MakeGetTransactionParams) Issue: tx_hash loaded from storage is passed directly to base::HexStringToString without length validation. If storage is corrupted, partial hashes could be sent to RPC. Fix: Validate tx_hash is exactly 64 hex characters before calling GetTransaction This is an optimization to avoid getting a repeated RPC failure from this. Presumably if this fails we should probably throw the tx_hash away from storage and…

Timeline (1 of 5 events)
  1. 2026-01-16 04:50 Label added priority/P4 by kdenhartog

Recorded changes

  1. New issue

    New bug report: [ZCash] Missing tx_hash length validation before RPC call

    Opened in brave-browser#52029. This is a report or request, not a confirmed change to Brave Wallet.

    brave-browser#52029
    Evidence
    • created 2026-01-16T03:05:25Z

    Source time: · Detected: · Backfilled from source history

    2026-01-16T03:05:25Z