PT-2023-22770

CVE-2023-30543

تاريخ النشر

2023-04-17

تاريخ التحديث

2023-05-01

الوصف من

CVSS 3.1

5.2

متوسطة

المقاييسAV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions @web3-react versions prior to the updated npm artifacts

Description The chainId may be outdated if the user changes chains as part of the connection flow, causing the value of chainId returned by useWeb3React() to be incorrect. This can lead to incorrect data derived from chainId, such as a wrapped token contract address in a swapping application, potentially causing users to send funds to the incorrect address.

Recommendations For @web3-react versions prior to the updated npm artifacts, upgrade to at least:

@web3-react/coinbase-wallet@^8.0.35-beta.0
@web3-react/eip1193@^8.0.27-beta.0
@web3-react/metamask@^8.0.30-beta.0
@web3-react/walletconnect@^8.0.37-beta.0 As a temporary workaround, consider verifying the chainId value before deriving any critical data from it.

قابلية الاستغلال

استغلال

إصلاح

التأثيرات

الباحثون

Andrewmohawk

المورّدون

المنتجات المتأثرة