Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@web3-react/metamask

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.2npmPublished

    chainId may be outdated if user changes chains as part of connection in @web3-react

    CVE-2023-30543 · GHSA-8pf3-6fgr-3g3g

    Affected
    • npm @web3-react/metamask >= 6.0.0, < 8.0.30-beta.0
    Fixed in
    8.0.30-beta.0· Vendor fix available
    Issue
    Impact `chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may be incorrect. In an application, this means that any data derived from `chainId` could be incorrect. For example, if a swapping application derives a wrapped token contract address from the `chainId` *and* a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping. This is a common approach when using other foundational libraries like `ethers`, and most users of v8 will want to upgrade past the affected versions. Patches Patched in https://github.com/Uniswap/web3-react/pull/749. Users of web3-react@8.0.x-beta.0 should upgrade to at least: - @web3-react/coinbase-wallet@^8.0.35-beta.0 - @web3-react/eip1193@^8.0.27-beta.0 - @web3-react/metamask@^8.0.30-beta.0 -…

    Recommended action: Upgrade to 8.0.30-beta.0 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →