fix: upgrade eth-abi to patched release

blockchain/eth_abi_security_test.py

@@ -0,0 +1,16 @@
+import unittest
+
+from eth_abi import decode
+
+
+class TestEthAbiSecurity(unittest.TestCase):
+    def test_zero_sized_tuple_array_is_rejected(self):
+        # Offset to a dynamic array followed by an attacker-controlled huge length.
+        payload = bytes.fromhex("00" * 31 + "20" + "00" * 28 + "FFFFFFFF")
+
+        with self.assertRaisesRegex(ValueError, "Zero-sized tuple"):
+            decode(["()[]"], payload)
+
+
+if __name__ == "__main__":
+    unittest.main()

blockchain/requirements.txt

@@ -4,7 +4,9 @@ python==3.9.5
 # Blockchain dependencies
 bitcoinlib==0.4.9
 ethereum==2.3.1
-web3==5.23.0
+web3==6.20.4
+# 5.0.1+ rejects zero-sized ABI tuples and recursive decoder payloads.
+eth-abi==5.2.0
 
 # API dependencies
 fastapi==0.65.2