NEAR One Foreign Transaction Validation

Findings · 6

1. 1 Duplicate requests overwrite pending yield promises Medium
2. 2 MpcContract::respond_verify_foreign_tx does not check that payload_hash matches the response High
3. 3 verify_foreign_transaction does not charge properly for storage Low
4. 4 Several voting methods accept cross-contract calls under the participant’s signer identity High
5. 5 Node provider ordering depends only on request ID and local configuration quirks Medium
6. 6 API tokens always have a prefix in authentication headers (defaults to “Bearer”) Informational

Findings extracted from the published report PDF. See the full report below for details and remediation.