Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TOB-FUEL-37: Ethabi dependency is no longer maintained #1332

Open
xgreenx opened this issue Aug 29, 2023 · 1 comment
Open

TOB-FUEL-37: Ethabi dependency is no longer maintained #1332

xgreenx opened this issue Aug 29, 2023 · 1 comment
Labels
audit-report Somehow related to the audit report

Comments

@xgreenx
Copy link
Collaborator

xgreenx commented Aug 29, 2023

Description

The ethabi dependency is no longer maintained. More details on 4. of September 2023.

Because the Fuel system does not have server components which parse user provided ABI specifications, this does not pose a security risk to Fuel.

Recommendations

Short term, upgrade ethabi as soon as a fixed version is released.
Long term, consider switching to an alternative library like ethers-rs. Note that the current version of ethers-rs is also vulnerable to the same bug as ethabi, so make sure to update the library if fixes are released.

@xgreenx xgreenx added the audit-report Somehow related to the audit report label Aug 29, 2023
@xgreenx
Copy link
Collaborator Author

xgreenx commented Oct 11, 2023

We've upgraded the fuel-core to use ethers 2 #1390. But the problem is still present there.

As mentioned in the description, it doesn't affect us because we don't have a server part. So the problem is not super relevant. But we will keep this issue open for now to track the upgrade to the ethers when the fix is available.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
audit-report Somehow related to the audit report
Projects
None yet
Development

No branches or pull requests

1 participant