The @bsv/wallet-toolbox library contains a critical flaw that enables unauthorized fund redirection by untrusted storage providers, necessitating an immediate update to version 2.4.0.

The vulnerability is caused by improper validation of transaction consistency, where the software blindly trusts output locking scripts returned by a remote StorageClient. This allows an unauthenticated remote storage provider to manipulate transaction outputs, effectively siphoning funds while the application interface displays the legitimate intended recipient.

The exploitation of this vulnerability results in direct financial loss for users and organizations utilizing the affected wallet components. With a CVSS score of 8.7, the impact on integrity is severe because the application fails to verify the authenticity of the transaction data it processes. This creates a significant risk of theft, potential legal liability, and profound reputational damage for any service relying on these packages for secure asset management.

Immediate Action: Update all instances of @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, and @bsv/wallet-toolbox-mobile to version 2.4.0 or later.

Proactive Monitoring: Audit application logs for connections to unauthorized or suspicious StorageClient providers and monitor transaction broadcast patterns for unexpected destination addresses.

Compensating Controls: If upgrading is not immediately possible, migrate to local storage solutions or implement independent, manual verification of every transaction output locking script and value against the original request before authorizing any signature.

Public Exploit Available: Unknown

Given the high severity of this vulnerability and the potential for direct financial theft, organizations must prioritize the update to version 2.4.0 as a matter of urgency. If your environment cannot be patched immediately, you should cease the use of remote StorageClient providers to prevent potential exploitation. Thoroughly review all transaction workflows that utilize these libraries to ensure that verification logic is robust and independent of external storage provider inputs.