PT-2023-22770 · Npm · @Web3-React/Metamask+4

Andrewmohawk · Published 2023-04-17 · Updated 2023-05-01 · CVE-2023-30543

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions @web3-react versions prior to the updated npm artifacts

Description The chainId may be outdated if the user changes chains as part of the connection flow, causing the value of chainId returned by useWeb3React() to be incorrect. This can lead to incorrect data derived from chainId, such as a wrapped token contract address in a swapping application, potentially causing users to send funds to the incorrect address.

Recommendations For @web3-react versions prior to the updated npm artifacts, upgrade to at least:

• @web3-react/coinbase-wallet@^8.0.35-beta.0
• @web3-react/eip1193@^8.0.27-beta.0
• @web3-react/metamask@^8.0.30-beta.0
• @web3-react/walletconnect@^8.0.37-beta.0 As a temporary workaround, consider verifying the chainId value before deriving any critical data from it.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2023-30543

GHSA-8PF3-6FGR-3G3G

Affected Products

@Web3-React

@Web3-React/Coinbase-Wallet

@Web3-React/Eip1193

@Web3-React/Metamask

@Web3-React/Walletconnect

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30543.json · Exploit
• https://github.com/Uniswap/web3-react/pull/749 · Patch
• https://github.com/Uniswap/web3-react/security/advisories/GHSA-8pf3-6fgr-3g3g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-30543 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30543 · Security Note
• https://osv.dev/vulnerability/GHSA-8pf3-6fgr-3g3g · Vendor Advisory
• https://github.com/Uniswap/web3-react · Note
• https://t.me/cvenotify/49482 · Telegram Post
• https://t.me/cvenotify/48469 · Telegram Post