PT-2023-22770

CVE-2023-30543

Publicado

2023-04-17

Atualizado

2023-05-01

Descrição por

CVSS 3.1

5.2

Média

MétricasAV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions @web3-react versions prior to the updated npm artifacts

Description The chainId may be outdated if the user changes chains as part of the connection flow, causing the value of chainId returned by useWeb3React() to be incorrect. This can lead to incorrect data derived from chainId, such as a wrapped token contract address in a swapping application, potentially causing users to send funds to the incorrect address.

Recommendations For @web3-react versions prior to the updated npm artifacts, upgrade to at least:

@web3-react/coinbase-wallet@^8.0.35-beta.0
@web3-react/eip1193@^8.0.27-beta.0
@web3-react/metamask@^8.0.30-beta.0
@web3-react/walletconnect@^8.0.37-beta.0 As a temporary workaround, consider verifying the chainId value before deriving any critical data from it.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Andrewmohawk

Fornecedores

Produtos afetados