Severity: INFORMATIONAL
Feature: System / Consensus Pseudo-Transactions
tfEnableAmendmentMask applied to ttFEE and ttUNL_MODIFY pseudo-transactions after LendingProtocol
Severity: LOW
All three pseudo-transaction types share the Change transactor. After featureLendingProtocol, tfEnableAmendmentMask (designed for ttAMENDMENT) is applied uniformly to all types. ttFEE and ttUNL_MODIFY with tfGotMajority or tfLostMajority flags would pass preflight.
Root cause: Shared Change transactor (using EnableAmendment = Change; using SetFee = Change; using UNLModify = Change) means all types share one preflight. Flag mask not differentiated by type.
src/libxrpl/tx/transactors/system/Change.cpp:18-23
include/xrpl/tx/transactors/system/Change.h:41-43
Exploit scenario: No practical exploit. Pseudo-transactions are generated internally by consensus code that doesn't set inappropriate flags.
Financial impact: None.
Suggested fix: Add switch on getTxnType to differentiate flag masks per pseudo-transaction type.
Severity: INFORMATIONAL
Feature: System / Consensus Pseudo-Transactions
tfEnableAmendmentMask applied to ttFEE and ttUNL_MODIFY pseudo-transactions after LendingProtocol
Severity: LOW
All three pseudo-transaction types share the Change transactor. After featureLendingProtocol, tfEnableAmendmentMask (designed for ttAMENDMENT) is applied uniformly to all types. ttFEE and ttUNL_MODIFY with tfGotMajority or tfLostMajority flags would pass preflight.
Root cause: Shared Change transactor (using EnableAmendment = Change; using SetFee = Change; using UNLModify = Change) means all types share one preflight. Flag mask not differentiated by type.
src/libxrpl/tx/transactors/system/Change.cpp:18-23
include/xrpl/tx/transactors/system/Change.h:41-43
Exploit scenario: No practical exploit. Pseudo-transactions are generated internally by consensus code that doesn't set inappropriate flags.
Financial impact: None.
Suggested fix: Add switch on getTxnType to differentiate flag masks per pseudo-transaction type.