From 42241ae3d6acf7486462a5989f217f24a49b7138 Mon Sep 17 00:00:00 2001
From: saragsil <40894848+saragsil@users.noreply.github.com>
Date: Mon, 31 Aug 2026 21:08:51 +0300
Subject: [PATCH] fix: upgrade eth-abi to patched release

---
 blockchain/eth_abi_security_test.py | 16 ++++++++++++++++
 blockchain/requirements.txt         |  4 +++-
 2 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 blockchain/eth_abi_security_test.py

diff --git a/blockchain/eth_abi_security_test.py b/blockchain/eth_abi_security_test.py
new file mode 100644
index 0000000..3161482
--- /dev/null
+++ b/blockchain/eth_abi_security_test.py
@@ -0,0 +1,16 @@
+import unittest
+
+from eth_abi import decode
+
+
+class TestEthAbiSecurity(unittest.TestCase):
+    def test_zero_sized_tuple_array_is_rejected(self):
+        # Offset to a dynamic array followed by an attacker-controlled huge length.
+        payload = bytes.fromhex("00" * 31 + "20" + "00" * 28 + "FFFFFFFF")
+
+        with self.assertRaisesRegex(ValueError, "Zero-sized tuple"):
+            decode(["()[]"], payload)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/blockchain/requirements.txt b/blockchain/requirements.txt
index 058119f..0d0a0e8 100644
--- a/blockchain/requirements.txt
+++ b/blockchain/requirements.txt
@@ -4,7 +4,9 @@ python==3.9.5
 # Blockchain dependencies
 bitcoinlib==0.4.9
 ethereum==2.3.1
-web3==5.23.0
+web3==6.20.4
+# 5.0.1+ rejects zero-sized ABI tuples and recursive decoder payloads.
+eth-abi==5.2.0
 
 # API dependencies
 fastapi==0.65.2