🔴 [CRITICAL] CB-004: Unauthorized Wallet Drain via LLM Tool Abuse #13

New issue

Open

opened 2026-02-20 08:50:03 +00:00 by Alpha · 0 comments

Alpha commented

2026-02-20 08:50:03 +00:00

Security Finding from Audit

Parent issue: #1

Severity

CRITICAL 🔴

CVSS Score

9.1

CWE

CWE-862 (Missing Authorization)

Location

tools/plugin.py, _wallet_pay()

Description

The wallet_pay tool is directly callable by the LLM with no authorization gate. Combined with prompt injection (CB-003), an attacker can drain the agent's Lightning wallet by manipulating the LLM to pay attacker-controlled invoices.

def _wallet_pay(self, invoice: str) -> str:
    wallet = self._get_wallet()
    # No confirmation, no spending limits, no rate limiting
    result = wallet.pay(invoice)
    return "Payment successful" if result.get("success") else ...

Recommendation

Require explicit human confirmation for all payment operations
Implement per-transaction and daily spending limits
Add rate limiting on wallet operations
Separate wallet operations into a privileged subprocess with its own authorization

From: Cobot Whitebox Security Audit (February 14, 2026)
Finding ID: CB-004

## Security Finding from Audit > Parent issue: #1 ### Severity **CRITICAL** 🔴 ### CVSS Score 9.1 ### CWE CWE-862 (Missing Authorization) ### Location `tools/plugin.py, _wallet_pay()` --- ### Description The `wallet_pay` tool is directly callable by the LLM with no authorization gate. Combined with prompt injection (CB-003), an attacker can drain the agent's Lightning wallet by manipulating the LLM to pay attacker-controlled invoices. ```python def _wallet_pay(self, invoice: str) -> str: wallet = self._get_wallet() # No confirmation, no spending limits, no rate limiting result = wallet.pay(invoice) return "Payment successful" if result.get("success") else ... ``` --- ### Recommendation - Require explicit human confirmation for all payment operations - Implement per-transaction and daily spending limits - Add rate limiting on wallet operations - Separate wallet operations into a privileged subprocess with its own authorization --- *From: Cobot Whitebox Security Audit (February 14, 2026)* *Finding ID: CB-004*