@exodus/ethereum-api 8.29.1 → 8.29.2

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [8.29.2](https://github.com/ExodusMovement/assets/compare/@exodus/ethereum-api@8.29.1...@exodus/ethereum-api@8.29.2) (2025-02-11)
+
+
+### Bug Fixes
+
+
+* fix: security hardening (#5035)
+
+
+
 ## [8.29.1](https://github.com/ExodusMovement/assets/compare/@exodus/ethereum-api@8.29.0...@exodus/ethereum-api@8.29.1) (2025-02-10)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/ethereum-api",
-  "version": "8.29.1",
+  "version": "8.29.2",
   "description": "Transaction monitors, fee monitors, RPC with the blockchain node, and other networking code for Ethereum and EVM-based blockchains",
   "type": "module",
   "main": "src/index.js",
@@ -64,5 +64,5 @@
     "type": "git",
     "url": "git+https://github.com/ExodusMovement/assets.git"
   },
-  "gitHead": "568c314fb59b4dee5fe4a83148c8f6863b2efe09"
+  "gitHead": "d9dacbc9ccadf109a2a2b10e97c35c46759e803e"
 }

package/src/eth-like-util.js

@@ -119,7 +119,7 @@ export const getIsForwarderContract = memoizeLruCache(
 const ERC20 = new SolidityContract(ABI.erc20)
 const ERC20BytesParams = new SolidityContract(ABI.erc20BytesParams)
 const DEFAULT_PARAM_NAMES = ['decimals', 'name', 'symbol']
-const erc20ParamsCache = {}
+const erc20ParamsCache = Object.create(null)
 
 export const getERC20Params = async ({ asset, address, paramNames = DEFAULT_PARAM_NAMES } = {}) => {
   assert(asset, 'getERC20Params(): asset required')

package/src/tx-log/clarity-monitor.js

@@ -176,7 +176,7 @@ export class ClarityMonitor extends BaseMonitor {
 
   async getNewAccountState({ tokens, currentTokenBalances, ourWalletAddress }) {
     const asset = this.asset
-    const newAccountState = {}
+    const newAccountState = Object.create(null)
     const balances = await this.getBalances({ tokens, ourWalletAddress })
     if (isRpcBalanceAsset(asset)) {
       const balance = balances[asset.name]
@@ -199,7 +199,7 @@ export class ClarityMonitor extends BaseMonitor {
 
   async getReceiveAddressesByWalletAccount() {
     const walletAccounts = await this.aci.getWalletAccounts({ assetName: this.asset.name })
-    const addressesByAccount = {}
+    const addressesByAccount = Object.create(null)
     for (const walletAccount of walletAccounts) {
       addressesByAccount[walletAccount] = await this.aci.getReceiveAddresses({
         assetName: this.asset.name,
@@ -220,7 +220,7 @@ export class ClarityMonitor extends BaseMonitor {
   }
 
   async getBalances({ tokens, ourWalletAddress }) {
-    const batch = {}
+    const batch = Object.create(null)
     if (isRpcBalanceAsset(this.asset)) {
       const request = this.server.getBalanceRequest(ourWalletAddress)
       batch[this.asset.name] = request

package/src/tx-log/ethereum-monitor.js

@@ -230,7 +230,7 @@ export class EthereumMonitor extends BaseMonitor {
 
   async getNewAccountState({ tokens, currentTokenBalances, ourWalletAddress }) {
     const asset = this.asset
-    const newAccountState = {}
+    const newAccountState = Object.create(null)
     const server = this.server
     if (isRpcBalanceAsset(asset)) {
       const result = await server.getBalanceProxied(ourWalletAddress)
@@ -255,7 +255,7 @@ export class EthereumMonitor extends BaseMonitor {
 
   async getReceiveAddressesByWalletAccount() {
     const walletAccounts = await this.aci.getWalletAccounts({ assetName: this.asset.name })
-    const addressesByAccount = {}
+    const addressesByAccount = Object.create(null)
     for (const walletAccount of walletAccounts) {
       addressesByAccount[walletAccount] = await this.aci.getReceiveAddresses({
         assetName: this.asset.name,

package/src/tx-log/ethereum-no-history-monitor.js

@@ -63,7 +63,7 @@ export class EthereumNoHistoryMonitor extends BaseMonitor {
 
   async getNewAccountState({ tokens, currentTokenBalances, ourWalletAddress }) {
     const asset = this.asset
-    const newAccountState = {}
+    const newAccountState = Object.create(null)
     const balances = await this.getBalances({ tokens, ourWalletAddress })
     const balance = balances[asset.name]
     newAccountState.balance = asset.currency.baseUnit(balance)

package/src/tx-log/monitor-utils/exclude-unchanged-token-balances.js

@@ -8,5 +8,5 @@ export function excludeUnchangedTokenBalances(currentTokenBalances, newTokenBala
     }
 
     return tokenBalancesAcc
-  }, {})
+  }, Object.create(null))
 }