Description
txio sui balance <addr> renders coin types by stripping the package address whenever the full type string is longer than 30 chars:
// cli/src/cli/handlers.rs:506-517
let short_coin = if coin_type.len() > 30 {
let parts: Vec<&str> = coin_type.split("::").collect();
if parts.len() >= 3 {
format!("{}::{}", parts[1].blue(), parts[2].cyan())
} else {
truncate_utf8_for_display(coin_type, 10, 10)
.cyan()
.to_string()
}
} else {
coin_type.cyan().to_string()
};Verified
A Sui coinType is <package_address>::<module>::<TypeName>. Package addresses are 66 chars (0x + 64 hex), so essentially every non-native coin takes the len() > 30 branch (0x2::sui::SUI at 13 chars is the only realistic exception), which discards parts[0] — the package address — entirely, showing only module::TypeName.
Since anyone can permissionlessly mint and send an arbitrary coin to any address on Sui, an attacker can deploy a scam coin using a common module/type naming pattern (e.g. coin::COIN, widely used by real wrapped-asset bridges) from a different package, and it becomes visually indistinguishable in this table from a legitimate token — the one field that actually identifies the coin (the package address) is never shown, not even truncated. Raw/--pretty JSON output is unaffected; this is specifically a spoofing risk in the human-facing table.
Suggested fix
Include a truncated prefix of the package address (e.g. 0x1234…abcd::coin::COIN) instead of dropping it, or show the full coinType and let terminal wrapping handle width.
Description
txio sui balance <addr>renders coin types by stripping the package address whenever the full type string is longer than 30 chars:Verified
A Sui
coinTypeis<package_address>::<module>::<TypeName>. Package addresses are 66 chars (0x+ 64 hex), so essentially every non-native coin takes thelen() > 30branch (0x2::sui::SUIat 13 chars is the only realistic exception), which discardsparts[0]— the package address — entirely, showing onlymodule::TypeName.Since anyone can permissionlessly mint and send an arbitrary coin to any address on Sui, an attacker can deploy a scam coin using a common module/type naming pattern (e.g.
coin::COIN, widely used by real wrapped-asset bridges) from a different package, and it becomes visually indistinguishable in this table from a legitimate token — the one field that actually identifies the coin (the package address) is never shown, not even truncated. Raw/--prettyJSON output is unaffected; this is specifically a spoofing risk in the human-facing table.Suggested fix
Include a truncated prefix of the package address (e.g.
0x1234…abcd::coin::COIN) instead of dropping it, or show the fullcoinTypeand let terminal wrapping handle width.