CVE-2023-30543: fix: use up-to-date chainId/accounts when querying EIP1193-derived wallets by zzmp · Pull Request #749 · Uniswap/web3-react

Conversation

// Wallets may resolve eth_chainId and hang on eth_accounts pending user interaction, which may include changing

// chains; they should be requested serially, with accounts first, so that the chainId can settle.

const accounts = await this.provider.request<string[]>({ method: ‘eth_requestAccounts’ })

const chainId = await this.provider.request<string>({ method: ‘eth_chainId’ })

try {

// Wallets may resolve eth_chainId and hang on eth_accounts pending user interaction, which may include changing

// chains; they should be requested serially, with accounts first, so that the chainId can settle.

const accounts = await (eager ? this.provider.request({ method: ‘eth_accounts’ }) : this.provider

.then(() => this.activate(desiredChainId))

// Wallets may resolve eth_chainId and hang on eth_accounts pending user interaction, which may include changing

// chains; they should be requested serially, with accounts first, so that the chainId can settle.

const accounts = await this.provider.request({ method: ‘eth_requestAccounts’ }) as string[]

this.actions.update({ chainId, accounts })

this.actions.update({ chainId: parseChainId(chainId), accounts })

zzmp deleted the fix-initial-chain branch

February 1, 2023 23:12

This was referenced

Feb 2, 2023