Deployment Connect version 2.4.0

[yuli-ferna]

No description provided.

[coworker-bot]

[github_XLabs/portal-bridge-ui#1307]
XLabs/portal-bridge-ui #1307

Change Summary:

• Updated Wormhole SDK dependencies from version 1.11.0 to 1.13.1
• Upgraded ethers library from version 5.6.8 to 6.4.2
• Updated Wormhole Connect from version 2.3.0 to 2.4.0-beta.0-development
• Modified address validation logic for Ethereum/EVM addresses
• Updated package dependencies to be compatible with newer library versions

Risk Score: 5/10

• Explanation: Moderate risk due to significant library upgrades and changes in address validation logic

Potential Vulnerabilities:
File: apps/connect/src/utils/isValidAddress.ts:11-20

export const isValidAddress = async (
  address: string,
  chain: Chain
): Promise<boolean> => {
  if (isEVMChain(chain) || chain === "Worldchain")
    return ethers.isAddress(address);
  // ... other validation logic
}

• Explanation: The address validation method has been simplified, potentially reducing the rigor of address checking. The previous implementation included checksum validation which is now replaced with a single ethers.isAddress() call.

Code Smell:
File: apps/connect/src/utils/isValidAddress.ts:50

if (chain === "Evmos" && address.startsWith("0x")) {
  return ethers.isAddress(address);
}

• Explanation: The code relies on a simple prefix check for Evmos addresses, which might not be the most robust way to validate addresses for this specific chain.

Unintended Consequences:

1. File: apps/connect/package.json

"ethers": "^6.4.2"

• Explanation: Major version upgrade from ethers 5.x to 6.x introduces breaking changes that could require significant refactoring of existing code using ethers library.

2. File: apps/connect/src/utils/isValidAddress.ts

// Removed: const getEthereumAddressWithChecksum = (address: string): string => {
//   return ethers.utils.getAddress(address);
// };

• Explanation: Removal of detailed address checksum validation might introduce subtle validation issues, especially for EVM-compatible chains.

Debug Log:

• No debug logs were found in the provided diff.

Additional Observations:

• The PR introduces compatibility with newer SDK versions
• Address validation logic has been significantly simplified
• Potential for breaking changes in existing integrations due to library upgrades[github_XLabs/portal-bridge-ui#1307]