CVE-2024-41945: @fuel ts/account The Fuels-ts Typescript SDK Has Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3jcg-vx7f-j6qf",
  "modified" : "2024-07-30T21:37:54Z",
  "published" : "2024-07-30T21:13:42Z",
  "aliases" : [ "CVE-2024-41945" ],
  "summary" : "The fuels-ts typescript SDK has no awareness of to-be-spent transactions",
  "details" : "# Brief/Intro\n\nThe typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs.\n\nThe `Typescript SDK` provides the `fund` function which retrieves `UTXOs`, which belong to the owner and can be used to fund the request in question, from fuel's graphql api. These then get added to the request making it possible to send it to the network as it now has inputs which can be spent by its outputs. Now this works when a user only wants to fund one transaction per block as in the next block, the spent UTXO will not exist anymore. However if a user wants to fund multiple transactions within one block, the following can happen:\n\nIt is important to note, that the graphql API will return a random UTXO which has enough value to fund the transaction in question.\n\n- user has 2 spendable `UTXOs` in their wallet which can cover all expenses\n- user funds transaction `tA` with an input gotten from the API `iA`\n- user submits `tA` to fuel\n- `iA` is still in possession of the user as no new block has been produced\n- user funds a transaction `tB` and gets the same input `iA` from the API\n- user tries to submit transaction `tB` to fuel but now one of the following can happen:\n  - if the recipient and all other parameters are the same as in `tA`, submission will fail as `tB` will have the same `txHash` as `tA`\n  - if the parameters are different, there will be a collision in the `txpool` and `tA` will be removed from the `txpool`\n\n# Vulnerability Details\n\nThe problem occurs, because the `fund` function in `fuels-ts/packages/account/src/account.ts` gets the needed ressources statelessly with the function `getResourcesToSpend` without taking into consideration already used UTXOs:\n\n```ts\n async fund<T extends TransactionRequest>(request: T, params: EstimatedTxParams): Promise<T> {\n\n    // [...]\n\n    let missingQuantities: CoinQuantity[] = [];\n    Object.entries(quantitiesDict).forEach(([assetId, { owned, required }]) => {\n      if (owned.lt(required)) {\n        missingQuantities.push({\n          assetId,\n          amount: required.sub(owned),\n        });\n      }\n    });\n\n    let needsToBeFunded = missingQuantities.length > 0;\n    let fundingAttempts = 0;\n    while (needsToBeFunded && fundingAttempts < MAX_FUNDING_ATTEMPTS) {\n      const resources = await this.getResourcesToSpend(\n        missingQuantities,\n        cacheRequestInputsResourcesFromOwner(request.inputs, this.address)\n      ); // @audit-issue here we do not exclude ids we already got and used for another transaction in the current block\n\n      request.addResources(resources);\n\n      // [...]\n    }\n\n    // [...]\n\n    return request;\n  }\n```\n\n# Impact Details\n\nThis issue will lead to unexpected SDK behaviour. Looking at the scenario in `Brief/Intro`, it could have the following impacts for users:\n\n1. A transaction does not get included in the `txpool` / in a block\n1. A previous transaction silently gets removed from the `txpool` and replaced with a new one\n\n# Recommendation\n\nI would recommend adding a buffer to the `Account` class, in which retrieved `resources` are saved. These can then be provided to `getResourcesToSpend` to be excluded from future queries but need to be removed from the buffer if their respective transaction fails to be included, in order to be able to use those `resources` again in such cases.\n\n# Proof of Concept\n\nThe following PoC transfers 100 coins from `wallet2` to `wallet` after which `wallet2` has two `UTXOs` one with value `100` and one with a very high value (this is printed to the console). Afterwards, `wallet` will attempt transfering `80` coins back to `wallet2` twice in one block, each in a separate transaction. This should work perfectly fine as `wallet` has two `UTXOs` where each can cover the cost of each respective transaction. Now when running this one of the following will happen:\n\n1. both transfers from `wallet` to `wallet2` get a different `UTXO`. This is the case if execution is successful and `wallet2` has `80` coins more than `wallet` in the end.\n1. both transfers get the same `UTXO`. In this case the script will fail and throw an error as then both transactions will have the same hash\n\nIn order to execute this PoC, please deploy a local node with a blocktime of `5secs` as I wrote my PoC for that blocktime. Note that with a small change it will also work with other blocktimes. Then add the PoC to a file `poc_resources.ts` and compile it with `tsc poc_resources.ts`. Finally execute it with `node poc_resources.js`.\n\nSince the choice which `UTXO` is taken as input is random, it might take a few tries to trigger the bug!\n\n```ts\nimport { JsonAbi, Script, Provider, WalletUnlocked, Account, Predicate, Wallet, CoinQuantityLike, coinQuantityfy, EstimatedTxParams, BN, Coin, AbstractAddress, Address, Contract, ScriptTransactionRequest } from 'fuels';\n\nconst abi: JsonAbi = {\n  'encoding': '1',\n  'types': [\n    {\n      'typeId': 0,\n      'type': '()',\n      'components': [],\n      'typeParameters': null\n    }\n  ],\n  'functions': [\n    {\n      'inputs': [],\n      'name': 'main',\n      'output': {\n        'name': '',\n        'type': 0,\n        'typeArguments': null\n      },\n      'attributes': null\n    }\n  ],\n  'loggedTypes': [],\n  'messagesTypes': [],\n  'configurables': []\n};\n\nconst FUEL_NETWORK_URL = 'http://127.0.0.1:4000/v1/graphql';\n\nasync function executeTransaction() {\n\n  const provider = await Provider.create(FUEL_NETWORK_URL);\n  \n  const wallet: WalletUnlocked = Wallet.fromPrivateKey('0x37fa81c84ccd547c30c176b118d5cb892bdb113e8e80141f266519422ef9eefd', provider);\n  const wallet2: WalletUnlocked = Wallet.fromPrivateKey('0xde97d8624a438121b86a1956544bd72ed68cd69f2c99555b08b1e8c51ffd511c', provider);\n  const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\n\n\n  console.log(\"Balance wallet before: \", await wallet.getBalance());\n  console.log(\"Balance wallet2 before: \", await wallet2.getBalance());\n\n  wallet2.transfer(wallet.address, 100);\n\n  await sleep(5500);\n\n\n  await wallet.transfer(wallet2.address, 80);\n  console.log('wallet -> wallet2');\n\n  await wallet.transfer(wallet2.address, 80);\n  console.log('wallet -> wallet2');\n\n  console.log(\"Balance wallet after: \", await wallet.getBalance());\n  console.log(\"Balance wallet2 after: \", await wallet2.getBalance());\n};\n\nexecuteTransaction().catch(console.error);\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@fuel-ts/account"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.93.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-41945"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FuelLabs/fuels-ts/commit/16ee1bfe66733551d00f0a76c21e8a09ea33006f"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/FuelLabs/fuels-ts"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-07-30T21:13:42Z",
    "nvd_published_at" : "2024-07-30T20:15:04Z"
  }
}