F-2026-0002·information-disclosure

Reflected input in API validation error messages (/api/address/balance)

Fixedpentestblackboxtypescript
TL;DR

The /api/address/balance endpoint reflected untrusted user input from the `network` query parameter directly into validation error responses without truncation or normalization, creating downstream injection risk if consumed by a UI or log pipeline.

Severity
LOW
Impact
LOW
Likelihood
MEDIUM
Method
MManual review
CAT.
Complexity
LOW
Exploitability
MEDIUM
02Section · Description

Description

The endpoint /api/address/balance reflected untrusted user input from the network query parameter directly into the returned validation error message. When an invalid network value was provided, the API response included the attacker-controlled value in contents.errors[].message without truncation.

Example request:

GET /api/address/balance?address=<valid>&network=solanaLorem%20ipsum... Host: www.mynth.ai Origin: https://www.novaswap.io

While this behavior is common in validation frameworks, reflecting arbitrary input can increase downstream risk if the message is rendered in a UI component, forwarded to logs or monitoring systems, or processed by downstream services that do not properly escape content.

03Section · Impact

Impact

Low on its own. Becomes meaningful in the presence of a downstream consumer that renders error bodies into HTML or rich text, or where extremely long reflected strings could be used to craft log-injection payloads or response-splitting variants.

04Section · Recommendation

Recommendation

  • Avoid reflecting raw user input in error strings where possible.
  • If reflection is needed for debugging, truncate reflected values to a safe maximum length (50 to 100 characters) and normalize / escape untrusted content before including it in messages.

Novaswap: Confirmed. Zealynx: Fixed.

Status
Fixed
F-2026-0002