fix: upgrade eth-abi to patched release

[saragsil]

Pull Request

Description

Fixes the eth-abi decoder vulnerability reported in #37.

Main changes:

• upgrade Web3 from 5.23.0 to 6.20.4
• explicitly pin eth-abi to 5.2.0
• add a regression test for the reported zero-sized tuple payload

Type of Change

• Bugfix
• New feature
• Documentation update
• Other

Checklist

• I reviewed the available contribution guidance in the README.
• My code follows the existing style guidelines of this project.
• I have performed a self-review of my code.
• I have added tests that prove my fix is effective.
• Documentation changes are not applicable.
• Screenshots or examples are not applicable.

Verification

• python -m unittest blockchain.eth_abi_security_test -v passes
• dependency resolution succeeds with Web3 6.20.4 and eth-abi 5.2.0
• pip check reports no broken requirements
• pip-audit reports no known vulnerabilities

Related Issues

Fixes #37

Additional Notes

The repository does not appear to contain a separate CONTRIBUTING.md file, so the contribution guidance in the README was reviewed instead.

[github-actions]

Message that will be displayed on users' first pull request

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​web3@​5.23.0 ⏵ 6.20.4	-3	-1
	pypi/​eth-abi@​5.2.0

View full report

[kilo-code-bot]

Kilo Code Review could not run — your account is out of credits.

Add credits or switch to a free model to enable reviews on this change.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 503c2aa...42241ae on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Terraform		Aug 31, 2026 6:44p.m.	Review ↗
Swift		Aug 31, 2026 6:44p.m.	Review ↗
SQL		Aug 31, 2026 6:44p.m.	Review ↗
Shell		Aug 31, 2026 6:44p.m.	Review ↗
Secrets		Aug 31, 2026 6:44p.m.	Review ↗
Scala		Aug 31, 2026 6:44p.m.	Review ↗
Rust		Aug 31, 2026 6:44p.m.	Review ↗
Ruby		Aug 31, 2026 6:44p.m.	Review ↗
Python		Aug 31, 2026 6:44p.m.	Review ↗
PHP		Aug 31, 2026 6:44p.m.	Review ↗
Kotlin		Aug 31, 2026 6:44p.m.	Review ↗
JavaScript		Aug 31, 2026 6:44p.m.	Review ↗
Java		Aug 31, 2026 6:44p.m.	Review ↗
Go		Aug 31, 2026 6:44p.m.	Review ↗
Docker		Aug 31, 2026 6:44p.m.	Review ↗
C & C++		Aug 31, 2026 6:44p.m.	Review ↗
C#		Aug 31, 2026 6:44p.m.	Review ↗
Ansible		Aug 31, 2026 6:44p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[xhawk-ai]

📋 Review Summary

No findings on this pass.

The change upgrades the blockchain Web3/eth-abi dependency set to a patched eth-abi release and adds a regression test for the zero-sized tuple decoder payload. No blocking issues were found in the changed dependency pins or the added regression test.

🤖 Commands

Re-review the latest changes:

@xhawk-ai review again

Resolve all review threads and post a summary:

@xhawk-ai resolve all