CVE-2024-34155 BIP32 Derivation

#3442

BIP32 Derivation found in the API.

PoC

https://github.com/user-attachments/assets/ea845c64-2cc6-4eac-aa6e-901399068605

Integrity discrepancy found in centralized "Rewards" Ledger vs. Decentralized SDK UTXO State. (CORS/Middleware/Environment Isolation/Balance Derivation).

Account reveals material discrepancy between "earned" LBC and "spendable" LBC. The API records a variable amount. The SDK v0.113.0 remains unaware of these assets even after the master seed injection address gap widens.

Vulnerable code as it stands: tox.ini confirms blockchain and transactions operate in isolated environments. The Ghost Ledger 'transacts' credited rewards without corresponding UTXO elements to broadcast the "Blockchain" ledger. server.go Explicitly sets Access-Control-Origin: "*" permitting cross-origin theft of session tokens which uses Ghost balances before hitting the decentralized chain.

UTXOs of earned rewards are withheld, subsequently.

Sub-account isolation results in loss of user access to "Earned" rewards. JSON-RPC reveals unauthenticated local ports which allows Remote code execution if port 5279 is exposed via a browser-based "CORS bypass."

Start by reading the referenced #3442 and inspecting tox.ini, server.go, and the JSON-RPC surface around port 5279; use the supplied PoC to compare the API Rewards ledger with SDK v0.113.0 UTXO state. Done means the reported vulnerability scope is reproducible and confirmed, with the CORS, isolation, and ledger discrepancies resolved or disproved.