Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@fuel-ts/account

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.3npmAmendedPublished

    The fuels-ts typescript SDK has no awareness of to-be-spent transactions

    CVE-2024-41945 · GHSA-3jcg-vx7f-j6qf

    Affected
    • npm @fuel-ts/account < 0.93.0
    Fixed in
    0.93.0· Vendor fix available
    Issue
    Brief/Intro The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs. The Typescript SDK provides the fund function which retrieves UTXOs, which belong to the owner and can be used to fund the request in question, from fuel's graphql api. These then get added to the request making it possible to send it to the network as it now has inputs which can be spent by its outputs. Now this works when a user only wants to fund one transaction per block as in the next block, the spent UTXO will not exist anymore. However if a user wants to fund multiple transactions within one block, the following can happen: It is important to note, that the graphql API will return a random UTXO which has enough value to fund the transaction in question. - user has 2 spendable UTXOs in their wallet which can cover all expenses - user funds transaction tA with an input gotten from the API iA - user…

    Recommended action: Upgrade to 0.93.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →