Race Condition Affecting @web3-react/metamask package, versions >=8.0.1-alpha.0 <8.0.30-beta.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-WEB3REACTMETAMASK-5430442
- published 19 Apr 2023
- disclosed 18 Apr 2023
- credit Unknown
Introduced: 18 Apr 2023
CVE-2023-30543 Open this link in a new tabHow to fix?
Upgrade @web3-react/metamask to version 8.0.30-beta.0 or higher.
Overview
Affected versions of this package are vulnerable to Race Condition such that chainId may be outdated if the user changes chains as part of the connection flow. This means that the value of chainId returned by useWeb3React() may be incorrect. In an application, this means that any data derived from chainId could be incorrect.
Impact:
If a swapping application derives a wrapped token contract address from the chainId and a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping.