CVE-2023-30543

MEDIUM

Uniswap web3-react_coinbase-wallet 6.0.0-6.2.13 - Race Condition in Chain ID Update

Title source: llm
STIX 2.1

Description

@web3-react is a framework for building Ethereum Apps . In affected versions the `chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may be incorrect. In an application, this means that any data derived from `chainId` could be incorrect. For example, if a swapping application derives a wrapped token contract address from the `chainId` *and* a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping. This issue has been addressed in PR #749 and is available in updated npm artifacts. There are no known workarounds for this issue. Users are advised to upgrade.

References (2)

Core 2
Core References
Issue Tracking, Patch x_refsource_misc
https://github.com/Uniswap/web3-react/pull/749

Scores

CVSS v3 5.2
EPSS 0.0038
EPSS Percentile 29.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-362
Status published
Products (50)
uniswap/web3-react_coinbase-wallet 7.0.0 alpha0
uniswap/web3-react_coinbase-wallet 7.0.1 alpha0
uniswap/web3-react_coinbase-wallet 7.0.2 alpha0
uniswap/web3-react_coinbase-wallet 8.0.22 beta0
uniswap/web3-react_coinbase-wallet 8.0.23 beta0
uniswap/web3-react_coinbase-wallet 8.0.24 beta0
uniswap/web3-react_coinbase-wallet 8.0.25 beta0
uniswap/web3-react_coinbase-wallet 8.0.26 beta0
uniswap/web3-react_coinbase-wallet 8.0.27 beta0
uniswap/web3-react_coinbase-wallet 8.0.28 beta0
... and 40 more
Published Apr 17, 2023
Tracked Since Feb 18, 2026