Executive brief
The Fuel Typescript SDK, used for interacting with the Fuel blockchain, contains a flaw in how it manages transaction funding. When a user attempts to send multiple transactions quickly, the SDK may accidentally reuse the same digital assets (UTXOs) for different requests because it does not track which assets are already committed to pending transactions. This can cause transactions to fail or lead to one transaction being silently replaced by another in the network's processing pool.
Technical details
The vulnerability exists in the `fund` function within `fuels-ts/packages/account/src/account.ts`. The SDK retrieves Unspent Transaction Outputs (UTXOs) statelessly via the `getResourcesToSpend` function from the Fuel GraphQL API. Because the SDK is unaware of UTXOs already assigned to 'to-be-spent' transactions that have not yet been included in a block, it may assign the same UTXO to multiple transaction requests. If the transactions have different parameters, a collision occurs in the transaction pool (txpool), causing the earlier transaction to be removed and replaced by the newer one. If parameters are identical, the second transaction fails due to a duplicate hash. This is fixed in version 0.93.0 by implementing a UTXO caching mechanism.
Affected products
- FuelLabs @fuel-ts/account < 0.93.0
- FuelLabs fuels < 0.93.0
Timeline
- 2024-07-30: advisory: GitHub Security Advisory GHSA-3jcg-vx7f-j6qf published
- 2024-07-30: patched: Fixed in version 0.93.0