This article was first published on Horizen
It is recommended for everyone relying on the library in their software to upgrade to the latest version v1.2.0 which includes a fix for this bug.
Zencashjs versions prior to v1.2.0 rely on a string comparison of the first two characters of a Horizen address to determine the destination address type of a transaction (P2PKH or P2SH). Due to the base58 address prefixes chosen in Horizen there exists the possibility of a clash of address prefixes for testnet P2PKH and mainnet P2SH addresses, testnet P2PKH addresses start with “zt” while a subset of mainnet P2SH addresses can also start with “zt”.
Zencashjs versions prior to v1.2.0 interpret transactions sent to a “zt” P2SH address on mainnet as P2PKH transactions erroneously. Any funds sent to a mainnet P2SH multisignature address starting with “zt” will be sent to the wrong address and be lost.
Affected wallets by Horizen:
Arizen <= v1.2.0
Sphere by Horizen in light client mode <= 1.0.1-beta
Zen Mobile Wallet <= v0.0.14
Updated versions of Horizen maintained wallets are expected over the next few days.
Wallets by Horizen not affected by this bug:
To keep reading, please go to the original article at: