Skip to content

[Snyk] Security upgrade web3 from 6.20.4 to 7.15.0 #631

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
revan-zhang wants to merge 1 commit into
base: touch
Choose a base branch
from
+1 −1
Open

[Snyk] Security upgrade web3 from 6.20.4 to 7.15.0 #631

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion python/requirements-optional.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
hidapi >= 0.7.99.post20
web3 >= 4.8
web3>=7.15.0

@devin-ai-integration devin-ai-integration Bot Apr 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 web3 version bumped to >=7.15.0 but code uses removed camelCase API methods

Bumping web3 to >=7.15.0 breaks all Ethereum CLI functionality because web3.py v7 removed all camelCase method aliases that the code depends on. I verified by installing web3 7.15.0 that isConnected, estimateGas, getTransactionCount, sendRawTransaction, encodeABI no longer exist (all return False for hasattr).

All broken call sites
  • python/src/trezorlib/cli/ethereum.py:158-159: contract.encodeABI(...) → should be contract.encode_abi(...)
  • python/src/trezorlib/cli/ethereum.py:393: _get_web3().isConnected() → should be _get_web3().is_connected()
  • python/src/trezorlib/cli/ethereum.py:428: .eth.estimateGas(...) → should be .eth.estimate_gas(...)
  • python/src/trezorlib/cli/ethereum.py:438: .eth.getTransactionCount(...) → should be .eth.get_transaction_count(...)
  • python/src/trezorlib/cli/ethereum.py:467: .eth.gasPrice → should be .eth.gas_price
  • python/src/trezorlib/cli/ethereum.py:522: .eth.sendRawTransaction(...) → should be .eth.send_raw_transaction(...)
  • python/src/trezorlib/cli/ethereum_onekey.py:143: contract.encodeABI(...) → should be contract.encode_abi(...)
  • python/src/trezorlib/cli/ethereum_onekey.py:280: _get_web3().isConnected() → should be _get_web3().is_connected()
  • python/src/trezorlib/cli/ethereum_onekey.py:306: .eth.estimateGas(...) → should be .eth.estimate_gas(...)
  • python/src/trezorlib/cli/ethereum_onekey.py:316: .eth.getTransactionCount(...) → should be .eth.get_transaction_count(...)
  • python/src/trezorlib/cli/ethereum_onekey.py:339: .eth.gasPrice → should be .eth.gas_price
  • python/src/trezorlib/cli/ethereum_onekey.py:393: .eth.sendRawTransaction(...) → should be .eth.send_raw_transaction(...)
Prompt for agents 
The web3 version requirement was bumped from >=4.8 to >=7.15.0 in requirements-optional.txt, but the code in python/src/trezorlib/cli/ethereum.py and python/src/trezorlib/cli/ethereum_onekey.py still uses the old camelCase web3 API that was removed in web3.py v6+. All 12 call sites need to be updated to use the new snake_case API:

1. isConnected() -> is_connected()
2. eth.estimateGas() -> eth.estimate_gas()
3. eth.getTransactionCount() -> eth.get_transaction_count()
4. eth.sendRawTransaction() -> eth.send_raw_transaction()
5. eth.gasPrice -> eth.gas_price
6. contract.encodeABI() -> contract.encode_abi()

Additionally, python/setup.py line 30 still has web3>=4.8 in the ethereum extras_require, which is inconsistent with the new requirements-optional.txt. The setup.py should also be updated to web3>=7.15.0.

Note that there may be other breaking API changes in web3 v7 beyond the method renames (e.g., changes to the Web3() constructor, middleware API, etc.) that should also be reviewed.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

Pillow
stellar-sdk>=4.0.0,<6.0.0
rlp>=1.1.0 ; python_version<'3.7'
Loading