Static Frames Validation Security Fix

packages/frames-validator/package.json

@@ -40,7 +40,7 @@
   "dependencies": {
     "@noble/curves": "^1.3.0",
     "@noble/hashes": "^1.4.0",
-    "@xmtp/node-sdk": "^0.0.27",
+    "@xmtp/node-sdk": "^0.0.28",
     "@xmtp/proto": "^3.72.3",
     "uint8array-extras": "^1.4.0",
     "viem": "^2.16.5"

packages/frames-validator/src/validation.ts

@@ -28,7 +28,7 @@ export async function validateFramesPost(
     actionBodyBytes,
     signature,
     signedPublicKeyBundle,
-    installationId, // not necessary
+    installationId,
     installationSignature,
     inboxId,
   } = deserializeProtoMessage(messageBytes);
@@ -48,9 +48,17 @@ export async function validateFramesPost(
     }
   } else {
     // make sure inbox IDs match
-    const addressInboxId = await getInboxIdForAddress(walletAddress, env);
-    if (inboxId !== addressInboxId) {
-      throw new Error("Invalid inbox ID");
+    const authorized = await Client.isInstallationAuthorized(
+      inboxId,
+      installationId,
+    );
+    if (!authorized) {
+      throw new Error("Installation not a member of association state");
+    }
+
+    const isMember = await Client.isAddressAuthorized(inboxId, walletAddress);
+    if (!isMember) {
+      throw new Error("Unable to associate wallet address with inbox");
     }
 
     const digest = sha256(actionBodyBytes);

sdks/node-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmtp/node-sdk",
-  "version": "0.0.27",
+  "version": "0.0.28",
   "description": "XMTP Node client SDK for interacting with XMTP networks",
   "keywords": [
     "xmtp",
@@ -53,7 +53,7 @@
     "@xmtp/content-type-group-updated": "^1.0.1",
     "@xmtp/content-type-primitives": "^1.0.3",
     "@xmtp/content-type-text": "^1.0.1",
-    "@xmtp/node-bindings": "^0.0.22",
+    "@xmtp/node-bindings": "^0.0.25",
     "@xmtp/proto": "^3.72.3"
   },
   "devDependencies": {

sdks/node-sdk/src/Client.ts

@@ -172,6 +172,20 @@ export class Client {
     return this.#innerClient.isRegistered();
   }
 
+  async isAddressAuthorized(
+    inboxId: string,
+    address: string,
+  ): Promise<boolean> {
+    return this.#innerClient.isAddressAuthorized(inboxId, address);
+  }
+
+  async isInstallationAuthorized(
+    inboxId: string,
+    installationId: Uint8Array,
+  ): Promise<boolean> {
+    return this.#innerClient.isInstallationAuthorized(inboxId, installationId);
+  }
+
   async #createInboxSignatureText() {
     try {
       const signatureText = await this.#innerClient.createInboxSignatureText();

yarn.lock

@@ -5065,7 +5065,7 @@ __metadata:
     "@rollup/plugin-typescript": "npm:^12.1.1"
     "@types/bl": "npm:^5.1.4"
     "@xmtp/frames-client": "npm:^1.0.0"
-    "@xmtp/node-sdk": "npm:^0.0.27"
+    "@xmtp/node-sdk": "npm:^0.0.28"
     "@xmtp/proto": "npm:^3.72.3"
     "@xmtp/xmtp-js": "npm:^12.1.0"
     ethers: "npm:^6.10.0"
@@ -5086,7 +5086,27 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@xmtp/node-sdk@npm:^0.0.27, @xmtp/node-sdk@workspace:sdks/node-sdk":
+"@xmtp/node-bindings@npm:^0.0.25":
+  version: 0.0.25
+  resolution: "@xmtp/node-bindings@npm:0.0.25"
+  checksum: 10/336f9b2a4a8b2781f6c53a7dd444428893f5e04a927350c82fcb79e37e0cc69abcb86406ffedeaa28115f1b57801890309546a10c9e806e3ed81b18b9d8f1431
+  languageName: node
+  linkType: hard
+
+"@xmtp/node-sdk@npm:^0.0.27":
+  version: 0.0.27
+  resolution: "@xmtp/node-sdk@npm:0.0.27"
+  dependencies:
+    "@xmtp/content-type-group-updated": "npm:^1.0.1"
+    "@xmtp/content-type-primitives": "npm:^1.0.3"
+    "@xmtp/content-type-text": "npm:^1.0.1"
+    "@xmtp/node-bindings": "npm:^0.0.22"
+    "@xmtp/proto": "npm:^3.72.3"
+  checksum: 10/9937c77d4bd3f3ed8df2f9938e940e2c21a7c8e8f06506d227bb97939f8294e0ae6ec6bc1498f528274257d61f9142e38639aa123c3ddf086a98d9cd041c0161
+  languageName: node
+  linkType: hard
+
+"@xmtp/node-sdk@npm:^0.0.28, @xmtp/node-sdk@workspace:sdks/node-sdk":
   version: 0.0.0-use.local
   resolution: "@xmtp/node-sdk@workspace:sdks/node-sdk"
   dependencies:
@@ -5097,7 +5117,7 @@ __metadata:
     "@xmtp/content-type-group-updated": "npm:^1.0.1"
     "@xmtp/content-type-primitives": "npm:^1.0.3"
     "@xmtp/content-type-text": "npm:^1.0.1"
-    "@xmtp/node-bindings": "npm:^0.0.22"
+    "@xmtp/node-bindings": "npm:^0.0.25"
     "@xmtp/proto": "npm:^3.72.3"
     "@xmtp/xmtp-js": "workspace:^"
     fast-glob: "npm:^3.3.2"