`chainId` may be outdated if user changes chains as part of connection in @web3-react
Impact
chainId may be outdated if the user changes chains as part of the connection flow. This means that the value of chainId returned by useWeb3React() may be incorrect. In an application, this means that any data derived from chainId could be incorrect.
For example, if a swapping application derives a wrapped token contract address from the chainId and a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping. This is a common approach when using other foundational libraries like ethers, and most users of v8 will want to upgrade past the affected versions.
Patches
Patched in https://github.com/Uniswap/web3-react/pull/749. Users of web3-react@8.0.x-beta.0 should upgrade to at least:
- @web3-react/coinbase-wallet@^8.0.35-beta.0
- @web3-react/eip1193@^8.0.27-beta.0
- @web3-react/metamask@^8.0.30-beta.0
- @web3-react/walletconnect@^8.0.37-beta.0
Workarounds
N/A
References
N/A
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | @web3-react/coinbase-wallet | >= 6.0.0, < 8.0.35-beta.0 | 8.0.35-beta.0 |
| Paquete de npm | @web3-react/eip1193 | >= 6.0.0, < 8.0.27-beta | 8.0.27-beta |
| Paquete de npm | @web3-react/metamask | >= 6.0.0, < 8.0.30-beta.0 | 8.0.30-beta.0 |
| Paquete de npm | @web3-react/walletconnect | >= 6.0.0, < 8.0.37-beta.0 | 8.0.37-beta.0 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L- Debilidad (CWE)
CWE-362- Plataforma
- npm
- Paquete
@web3-react/coinbase-wallet, @web3-react/eip1193, @web3-react/metamask- Publicada
- 18.04.2023
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-8pf3-6fgr-3g3g - CC BY 4.0
Historial de vulnerabilidades: @web3-react/metamask
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.