canton-json-api

Warn

Audited by Snyk on Jun 25, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill exposes a ledger HTTP/JSON API with explicit transaction endpoints (POST /v2/commands/submit-and-wait, POST /v2/commands/async/submit, exercise commands), party management (POST /v2/parties), and external signing (POST /v2/interactive-submission/prepare and /execute). These are concrete, domain-specific ledger operations for creating contracts and exercising choices (i.e., submitting and signing transactions on a ledger) — functionality that directly effects state changes on a ledger and can be used to move asset ownership or value. This matches the definition of direct financial execution (blockchain/ledger transaction signing and submission).

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 25, 2026, 11:15 AM
Issues
1
Security Audit — snyk — canton-json-api