Foreign key can move funds
perm-active-spender
Foreign key can move funds is a Leeri screening rule for TRON that detects the following: A spending-capable active permission (transfer, freeze, delegate and similar operations) can be exercised by foreign keys alone.
What it detects
A spending-capable active permission (transfer, freeze, delegate and similar operations) can be exercised by foreign keys alone.
When it fires
A value-moving active permission's signing threshold is satisfiable entirely by keys outside this address.
What it means
Someone outside this address can transfer or otherwise move this account's assets without the owner's key. This can be an intended delegation, for example to a service that operates the wallet, or a sign that spending rights were handed to an attacker.
What to do
Check which operations and keys are listed with the finding, and confirm with the customer that the delegation is intended.
Chains
- TRON
Ruleset version:
Wallet security warning for the address owner · not scored from ruleset v11