Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Spike: Review impact of changing web3 with ethers #888

Closed
daveroga opened this issue Aug 22, 2022 · 3 comments
Closed

Spike: Review impact of changing web3 with ethers #888

daveroga opened this issue Aug 22, 2022 · 3 comments
Assignees

Comments

@daveroga
Copy link
Contributor

daveroga commented Aug 22, 2022

We have seen Web3 has some vulnerabilities in the libraries they use because of swarm-js using a library with vulnerabilities that is got: 7.1.0.
We will investigate the impact of moving this web3 with ethers library access the functionality about the contracts.

Document created for collection of different sources about migration from web3 to ethers for this spile:
https://hackmd.io/amVLUwo0TuuD1YGvXmnSTA

Test

Branch created for this spike to be tested daveroga\ethers-test which migrate the cli project from web3 to ethers to use nf3 with ethers. You can run npm run test-e2e-tokens and tests will be done through the new nf3 with ethers.

@daveroga daveroga mentioned this issue Aug 22, 2022
@daveroga daveroga self-assigned this Aug 23, 2022
@Westlad
Copy link
Contributor

Westlad commented Sep 8, 2022

The vulnerabilities are fixed in PR #908 by overriding the version of Got used.

@pawelgrzybek
Copy link
Contributor

@Westlad override is a good temporary solution until we have a fix in web3 itself. I would personally do this as an individual PR tho.

@Westlad
Copy link
Contributor

Westlad commented Sep 8, 2022

@pawelgrzybek I'm fine with including it in the PR, I take your point but I consider it to be a necessary part of the upgrade so I'm not minded to split it into two PRs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants