Skip to main content

Improper Input Validation

CVE-2024-41945

Low
3.1/10

Summary

The fuels-ts is a library for interacting with Fuel v2. The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already-used UTXOs. The problem occurs because the "fund" function in "fuels-ts/packages/account/src/account.ts" gets the needed resources statelessly with the function "getResourcesToSpend" without taking into consideration already used UTXOs. This issue will lead to unexpected SDK behaviour, such as a transaction not getting included in the "txpool" "/" in a block or a previous transaction silently getting removed from the "txpool" and replaced with a new one. This issue affects @fuel-ts/account versions prior to 0.93.0

  • HIGH
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • NONE

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published