CVE-2024-41945 (GCVE-0-2024-41945)

Vulnerability from cvelistv5 – Published: 2024-07-30 19:42 – Updated: 2024-08-02 04:54

Title

The fuels-ts typescript SDK has no awareness of to-be-spent transactions

Summary

fuels-ts is a library for interacting with Fuel v2. The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs. The problem occurs, because the `fund` function in `fuels-ts/packages/account/src/account.ts` gets the needed ressources statelessly with the function `getResourcesToSpend` without taking into consideration already used UTXOs. This issue will lead to unexpected SDK behaviour, such as a transaction not getting included in the `txpool` / in a block or a previous transaction silently getting removed from the `txpool` and replaced with a new one.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/FuelLabs/fuels-ts/security/adv…	x_refsource_CONFIRM

Impacted products

2 products

Vendor	Product	Version
FuelLabs	fuels-ts	Affected: < 0.93.0
fuellabs	fuels-ts	Affected: 0 , < 0.93.0 (custom) cpe:2.3:a:fuellabs:fuels-ts::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:fuellabs:fuels-ts:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fuels-ts",
            "vendor": "fuellabs",
            "versions": [
              {
                "lessThan": "0.93.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41945",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-31T13:27:12.497228Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-31T14:19:53.955Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:54:31.279Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fuels-ts",
          "vendor": "FuelLabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.93.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "fuels-ts is a library for interacting with Fuel v2.  The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs. The problem occurs, because the `fund` function in `fuels-ts/packages/account/src/account.ts` gets the needed ressources statelessly with the function `getResourcesToSpend` without taking into consideration already used UTXOs. This issue will lead to unexpected SDK behaviour, such as a transaction not getting included in the `txpool` / in a block or a previous transaction silently getting removed from the `txpool` and replaced with a new one."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-30T19:42:06.663Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf"
        }
      ],
      "source": {
        "advisory": "GHSA-3jcg-vx7f-j6qf",
        "discovery": "UNKNOWN"
      },
      "title": "The fuels-ts typescript SDK has no awareness of to-be-spent transactions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-41945",
    "datePublished": "2024-07-30T19:42:06.663Z",
    "dateReserved": "2024-07-24T16:51:40.947Z",
    "dateUpdated": "2024-08-02T04:54:31.279Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-41945",
      "date": "2026-06-10",
      "epss": "0.00163",
      "percentile": "0.37049"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41945\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-07-30T20:15:04.930\",\"lastModified\":\"2024-11-21T09:33:19.287\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"fuels-ts is a library for interacting with Fuel v2.  The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs. The problem occurs, because the `fund` function in `fuels-ts/packages/account/src/account.ts` gets the needed ressources statelessly with the function `getResourcesToSpend` without taking into consideration already used UTXOs. This issue will lead to unexpected SDK behaviour, such as a transaction not getting included in the `txpool` / in a block or a previous transaction silently getting removed from the `txpool` and replaced with a new one.\"},{\"lang\":\"es\",\"value\":\"fuels-ts es una librer\u00eda para interactuar con Fuel v2. El SDK mecanografiado no tiene conocimiento de las transacciones que se van a gastar, lo que hace que algunas transacciones fallen o se eliminen silenciosamente, ya que se financian con UTXO ya usados. El problema ocurre porque la funci\u00f3n `fund` en `fuels-ts/packages/account/src/account.ts` obtiene los recursos necesarios sin estado con la funci\u00f3n `getResourcesToSpend` sin tener en cuenta los UTXO ya utilizados. Este problema provocar\u00e1 un comportamiento inesperado del SDK, como que una transacci\u00f3n no se incluya en `txpool`/en un bloque o que una transacci\u00f3n anterior se elimine silenciosamente de `txpool` y se reemplace por una nueva.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":3.1,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"references\":[{\"url\":\"https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf\", \"name\": \"https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:54:31.279Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41945\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-31T13:27:12.497228Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:fuellabs:fuels-ts:*:*:*:*:*:*:*:*\"], \"vendor\": \"fuellabs\", \"product\": \"fuels-ts\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.93.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-31T14:19:49.017Z\"}}], \"cna\": {\"title\": \"The fuels-ts typescript SDK has no awareness of to-be-spent transactions\", \"source\": {\"advisory\": \"GHSA-3jcg-vx7f-j6qf\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 3.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"FuelLabs\", \"product\": \"fuels-ts\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.93.0\"}]}], \"references\": [{\"url\": \"https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf\", \"name\": \"https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"fuels-ts is a library for interacting with Fuel v2.  The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs. The problem occurs, because the `fund` function in `fuels-ts/packages/account/src/account.ts` gets the needed ressources statelessly with the function `getResourcesToSpend` without taking into consideration already used UTXOs. This issue will lead to unexpected SDK behaviour, such as a transaction not getting included in the `txpool` / in a block or a previous transaction silently getting removed from the `txpool` and replaced with a new one.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20: Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-07-30T19:42:06.663Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41945\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T04:54:31.279Z\", \"dateReserved\": \"2024-07-24T16:51:40.947Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-07-30T19:42:06.663Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-41945

Vulnerability from fkie_nvd - Published: 2024-07-30 20:15 - Updated: 2026-04-15 00:35

Severity

3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "fuels-ts is a library for interacting with Fuel v2.  The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs. The problem occurs, because the `fund` function in `fuels-ts/packages/account/src/account.ts` gets the needed ressources statelessly with the function `getResourcesToSpend` without taking into consideration already used UTXOs. This issue will lead to unexpected SDK behaviour, such as a transaction not getting included in the `txpool` / in a block or a previous transaction silently getting removed from the `txpool` and replaced with a new one."
    },
    {
      "lang": "es",
      "value": "fuels-ts es una librer\u00eda para interactuar con Fuel v2. El SDK mecanografiado no tiene conocimiento de las transacciones que se van a gastar, lo que hace que algunas transacciones fallen o se eliminen silenciosamente, ya que se financian con UTXO ya usados. El problema ocurre porque la funci\u00f3n `fund` en `fuels-ts/packages/account/src/account.ts` obtiene los recursos necesarios sin estado con la funci\u00f3n `getResourcesToSpend` sin tener en cuenta los UTXO ya utilizados. Este problema provocar\u00e1 un comportamiento inesperado del SDK, como que una transacci\u00f3n no se incluya en `txpool`/en un bloque o que una transacci\u00f3n anterior se elimine silenciosamente de `txpool` y se reemplace por una nueva."
    }
  ],
  "id": "CVE-2024-41945",
  "lastModified": "2026-04-15T00:35:42.020",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-07-30T20:15:04.930",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-3JCG-VX7F-J6QF

Vulnerability from github – Published: 2024-07-30 21:13 – Updated: 2024-07-30 21:37

Summary

The fuels-ts typescript SDK has no awareness of to-be-spent transactions

Details

Brief/Intro

The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs.

The Typescript SDK provides the fund function which retrieves UTXOs, which belong to the owner and can be used to fund the request in question, from fuel's graphql api. These then get added to the request making it possible to send it to the network as it now has inputs which can be spent by its outputs. Now this works when a user only wants to fund one transaction per block as in the next block, the spent UTXO will not exist anymore. However if a user wants to fund multiple transactions within one block, the following can happen:

It is important to note, that the graphql API will return a random UTXO which has enough value to fund the transaction in question.

user has 2 spendable UTXOs in their wallet which can cover all expenses
user funds transaction tA with an input gotten from the API iA
user submits tA to fuel
iA is still in possession of the user as no new block has been produced
user funds a transaction tB and gets the same input iA from the API
user tries to submit transaction tB to fuel but now one of the following can happen:
if the recipient and all other parameters are the same as in tA, submission will fail as tB will have the same txHash as tA
if the parameters are different, there will be a collision in the txpool and tA will be removed from the txpool

Vulnerability Details

The problem occurs, because the fund function in fuels-ts/packages/account/src/account.ts gets the needed ressources statelessly with the function getResourcesToSpend without taking into consideration already used UTXOs:

 async fund<T extends TransactionRequest>(request: T, params: EstimatedTxParams): Promise<T> {

    // [...]

    let missingQuantities: CoinQuantity[] = [];
    Object.entries(quantitiesDict).forEach(([assetId, { owned, required }]) => {
      if (owned.lt(required)) {
        missingQuantities.push({
          assetId,
          amount: required.sub(owned),
        });
      }
    });

    let needsToBeFunded = missingQuantities.length > 0;
    let fundingAttempts = 0;
    while (needsToBeFunded && fundingAttempts < MAX_FUNDING_ATTEMPTS) {
      const resources = await this.getResourcesToSpend(
        missingQuantities,
        cacheRequestInputsResourcesFromOwner(request.inputs, this.address)
      ); // @audit-issue here we do not exclude ids we already got and used for another transaction in the current block

      request.addResources(resources);

      // [...]
    }

    // [...]

    return request;
  }

Impact Details

This issue will lead to unexpected SDK behaviour. Looking at the scenario in Brief/Intro, it could have the following impacts for users:

A transaction does not get included in the txpool / in a block
A previous transaction silently gets removed from the txpool and replaced with a new one

Recommendation

I would recommend adding a buffer to the Account class, in which retrieved resources are saved. These can then be provided to getResourcesToSpend to be excluded from future queries but need to be removed from the buffer if their respective transaction fails to be included, in order to be able to use those resources again in such cases.

Proof of Concept

The following PoC transfers 100 coins from wallet2 to wallet after which wallet2 has two UTXOs one with value 100 and one with a very high value (this is printed to the console). Afterwards, wallet will attempt transfering 80 coins back to wallet2 twice in one block, each in a separate transaction. This should work perfectly fine as wallet has two UTXOs where each can cover the cost of each respective transaction. Now when running this one of the following will happen:

both transfers from wallet to wallet2 get a different UTXO. This is the case if execution is successful and wallet2 has 80 coins more than wallet in the end.
both transfers get the same UTXO. In this case the script will fail and throw an error as then both transactions will have the same hash

In order to execute this PoC, please deploy a local node with a blocktime of 5secs as I wrote my PoC for that blocktime. Note that with a small change it will also work with other blocktimes. Then add the PoC to a file poc_resources.ts and compile it with tsc poc_resources.ts. Finally execute it with node poc_resources.js.

Since the choice which UTXO is taken as input is random, it might take a few tries to trigger the bug!

import { JsonAbi, Script, Provider, WalletUnlocked, Account, Predicate, Wallet, CoinQuantityLike, coinQuantityfy, EstimatedTxParams, BN, Coin, AbstractAddress, Address, Contract, ScriptTransactionRequest } from 'fuels';

const abi: JsonAbi = {
  'encoding': '1',
  'types': [
    {
      'typeId': 0,
      'type': '()',
      'components': [],
      'typeParameters': null
    }
  ],
  'functions': [
    {
      'inputs': [],
      'name': 'main',
      'output': {
        'name': '',
        'type': 0,
        'typeArguments': null
      },
      'attributes': null
    }
  ],
  'loggedTypes': [],
  'messagesTypes': [],
  'configurables': []
};

const FUEL_NETWORK_URL = 'http://127.0.0.1:4000/v1/graphql';

async function executeTransaction() {

  const provider = await Provider.create(FUEL_NETWORK_URL);

  const wallet: WalletUnlocked = Wallet.fromPrivateKey('0x37fa81c84ccd547c30c176b118d5cb892bdb113e8e80141f266519422ef9eefd', provider);
  const wallet2: WalletUnlocked = Wallet.fromPrivateKey('0xde97d8624a438121b86a1956544bd72ed68cd69f2c99555b08b1e8c51ffd511c', provider);
  const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));


  console.log("Balance wallet before: ", await wallet.getBalance());
  console.log("Balance wallet2 before: ", await wallet2.getBalance());

  wallet2.transfer(wallet.address, 100);

  await sleep(5500);


  await wallet.transfer(wallet2.address, 80);
  console.log('wallet -> wallet2');

  await wallet.transfer(wallet2.address, 80);
  console.log('wallet -> wallet2');

  console.log("Balance wallet after: ", await wallet.getBalance());
  console.log("Balance wallet2 after: ", await wallet2.getBalance());
};

executeTransaction().catch(console.error);

Severity

3.1 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

2.3 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@fuel-ts/account"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.93.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-41945"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-30T21:13:42Z",
    "nvd_published_at": "2024-07-30T20:15:04Z",
    "severity": "LOW"
  },
  "details": "# Brief/Intro\n\nThe typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs.\n\nThe `Typescript SDK` provides the `fund` function which retrieves `UTXOs`, which belong to the owner and can be used to fund the request in question, from fuel\u0027s graphql api. These then get added to the request making it possible to send it to the network as it now has inputs which can be spent by its outputs. Now this works when a user only wants to fund one transaction per block as in the next block, the spent UTXO will not exist anymore. However if a user wants to fund multiple transactions within one block, the following can happen:\n\nIt is important to note, that the graphql API will return a random UTXO which has enough value to fund the transaction in question.\n\n- user has 2 spendable `UTXOs` in their wallet which can cover all expenses\n- user funds transaction `tA` with an input gotten from the API `iA`\n- user submits `tA` to fuel\n- `iA` is still in possession of the user as no new block has been produced\n- user funds a transaction `tB` and gets the same input `iA` from the API\n- user tries to submit transaction `tB` to fuel but now one of the following can happen:\n  - if the recipient and all other parameters are the same as in `tA`, submission will fail as `tB` will have the same `txHash` as `tA`\n  - if the parameters are different, there will be a collision in the `txpool` and `tA` will be removed from the `txpool`\n\n# Vulnerability Details\n\nThe problem occurs, because the `fund` function in `fuels-ts/packages/account/src/account.ts` gets the needed ressources statelessly with the function `getResourcesToSpend` without taking into consideration already used UTXOs:\n\n```ts\n async fund\u003cT extends TransactionRequest\u003e(request: T, params: EstimatedTxParams): Promise\u003cT\u003e {\n\n    // [...]\n\n    let missingQuantities: CoinQuantity[] = [];\n    Object.entries(quantitiesDict).forEach(([assetId, { owned, required }]) =\u003e {\n      if (owned.lt(required)) {\n        missingQuantities.push({\n          assetId,\n          amount: required.sub(owned),\n        });\n      }\n    });\n\n    let needsToBeFunded = missingQuantities.length \u003e 0;\n    let fundingAttempts = 0;\n    while (needsToBeFunded \u0026\u0026 fundingAttempts \u003c MAX_FUNDING_ATTEMPTS) {\n      const resources = await this.getResourcesToSpend(\n        missingQuantities,\n        cacheRequestInputsResourcesFromOwner(request.inputs, this.address)\n      ); // @audit-issue here we do not exclude ids we already got and used for another transaction in the current block\n\n      request.addResources(resources);\n\n      // [...]\n    }\n\n    // [...]\n\n    return request;\n  }\n```\n\n# Impact Details\n\nThis issue will lead to unexpected SDK behaviour. Looking at the scenario in `Brief/Intro`, it could have the following impacts for users:\n\n1. A transaction does not get included in the `txpool` / in a block\n1. A previous transaction silently gets removed from the `txpool` and replaced with a new one\n\n# Recommendation\n\nI would recommend adding a buffer to the `Account` class, in which retrieved `resources` are saved. These can then be provided to `getResourcesToSpend` to be excluded from future queries but need to be removed from the buffer if their respective transaction fails to be included, in order to be able to use those `resources` again in such cases.\n\n# Proof of Concept\n\nThe following PoC transfers 100 coins from `wallet2` to `wallet` after which `wallet2` has two `UTXOs` one with value `100` and one with a very high value (this is printed to the console). Afterwards, `wallet` will attempt transfering `80` coins back to `wallet2` twice in one block, each in a separate transaction. This should work perfectly fine as `wallet` has two `UTXOs` where each can cover the cost of each respective transaction. Now when running this one of the following will happen:\n\n1. both transfers from `wallet` to `wallet2` get a different `UTXO`. This is the case if execution is successful and `wallet2` has `80` coins more than `wallet` in the end.\n1. both transfers get the same `UTXO`. In this case the script will fail and throw an error as then both transactions will have the same hash\n\nIn order to execute this PoC, please deploy a local node with a blocktime of `5secs` as I wrote my PoC for that blocktime. Note that with a small change it will also work with other blocktimes. Then add the PoC to a file `poc_resources.ts` and compile it with `tsc poc_resources.ts`. Finally execute it with `node poc_resources.js`.\n\nSince the choice which `UTXO` is taken as input is random, it might take a few tries to trigger the bug!\n\n```ts\nimport { JsonAbi, Script, Provider, WalletUnlocked, Account, Predicate, Wallet, CoinQuantityLike, coinQuantityfy, EstimatedTxParams, BN, Coin, AbstractAddress, Address, Contract, ScriptTransactionRequest } from \u0027fuels\u0027;\n\nconst abi: JsonAbi = {\n  \u0027encoding\u0027: \u00271\u0027,\n  \u0027types\u0027: [\n    {\n      \u0027typeId\u0027: 0,\n      \u0027type\u0027: \u0027()\u0027,\n      \u0027components\u0027: [],\n      \u0027typeParameters\u0027: null\n    }\n  ],\n  \u0027functions\u0027: [\n    {\n      \u0027inputs\u0027: [],\n      \u0027name\u0027: \u0027main\u0027,\n      \u0027output\u0027: {\n        \u0027name\u0027: \u0027\u0027,\n        \u0027type\u0027: 0,\n        \u0027typeArguments\u0027: null\n      },\n      \u0027attributes\u0027: null\n    }\n  ],\n  \u0027loggedTypes\u0027: [],\n  \u0027messagesTypes\u0027: [],\n  \u0027configurables\u0027: []\n};\n\nconst FUEL_NETWORK_URL = \u0027http://127.0.0.1:4000/v1/graphql\u0027;\n\nasync function executeTransaction() {\n\n  const provider = await Provider.create(FUEL_NETWORK_URL);\n  \n  const wallet: WalletUnlocked = Wallet.fromPrivateKey(\u00270x37fa81c84ccd547c30c176b118d5cb892bdb113e8e80141f266519422ef9eefd\u0027, provider);\n  const wallet2: WalletUnlocked = Wallet.fromPrivateKey(\u00270xde97d8624a438121b86a1956544bd72ed68cd69f2c99555b08b1e8c51ffd511c\u0027, provider);\n  const sleep = (ms: number) =\u003e new Promise((resolve) =\u003e setTimeout(resolve, ms));\n\n\n  console.log(\"Balance wallet before: \", await wallet.getBalance());\n  console.log(\"Balance wallet2 before: \", await wallet2.getBalance());\n\n  wallet2.transfer(wallet.address, 100);\n\n  await sleep(5500);\n\n\n  await wallet.transfer(wallet2.address, 80);\n  console.log(\u0027wallet -\u003e wallet2\u0027);\n\n  await wallet.transfer(wallet2.address, 80);\n  console.log(\u0027wallet -\u003e wallet2\u0027);\n\n  console.log(\"Balance wallet after: \", await wallet.getBalance());\n  console.log(\"Balance wallet2 after: \", await wallet2.getBalance());\n};\n\nexecuteTransaction().catch(console.error);\n```",
  "id": "GHSA-3jcg-vx7f-j6qf",
  "modified": "2024-07-30T21:37:54Z",
  "published": "2024-07-30T21:13:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41945"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FuelLabs/fuels-ts/commit/16ee1bfe66733551d00f0a76c21e8a09ea33006f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FuelLabs/fuels-ts"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "The fuels-ts typescript SDK has no awareness of to-be-spent transactions"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-41945 (GCVE-0-2024-41945)

FKIE_CVE-2024-41945

GHSA-3JCG-VX7F-J6QF

Brief/Intro

Vulnerability Details

Impact Details

Recommendation

Proof of Concept

Tags

Sightings

Nomenclature