GHSA-xfrc-7mj2-5xh9: 
JavaScript vulnerability analysis and mitigation

The vulnerability (GHSA-xfrc-7mj2-5xh9) affects the zencashjs package versions prior to 1.2.0, discovered and disclosed in September 2020. This critical severity vulnerability involves undefined behavior in the package's handling of cryptocurrency wallet addresses. The issue specifically impacts the address handling mechanism in the Horizen cryptocurrency ecosystem (GitHub Advisory).

The vulnerability stems from the package's implementation of address type determination, which relies on a string comparison of the first two characters of a Horizen address to differentiate between P2PKH (Pay to Public Key Hash) and P2SH (Pay to Script Hash) transaction types. The issue arises due to a potential clash between address prefixes, specifically where testnet P2PKH and mainnet P2SH addresses can both start with "zt". This implementation flaw causes the package to incorrectly interpret transactions sent to a "zt" P2SH address on mainnet as P2PKH transactions (GitHub Advisory).

The vulnerability can result in permanent loss of funds when users attempt to send transactions to mainnet P2SH multisignature addresses that begin with "zt". In such cases, the funds are sent to the wrong address type due to the misinterpretation of the address format, making the funds irretrievable (GitHub Advisory).

The vulnerability is particularly concerning as it can be triggered during normal operation when users attempt to send funds to specific P2SH multisignature addresses. The issue occurs due to the address prefix collision between testnet P2PKH and mainnet P2SH addresses, making it a reliability issue rather than a traditional security exploit (GitHub Advisory).

The recommended mitigation is to upgrade to zencashjs version 1.2.0 or later, which addresses this vulnerability. The fix involves changing the address type determination mechanism to use the full address prefix rather than just the first two characters (GitHub Advisory, Zencash Commit).