Skip to content

[Snyk] Security upgrade web3 from 6.20.4 to 7.15.0 #422

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
revan-zhang wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Security upgrade web3 from 6.20.4 to 7.15.0 #422

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion python/requirements-optional.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
hidapi >= 0.7.99.post20
web3 >= 4.8
web3>=7.15.0

@devin-ai-integration devin-ai-integration Bot Apr 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 web3>=7.15.0 requirement breaks all Ethereum CLI commands due to removed camelCase APIs

Bumping the web3 minimum version from >=4.8 to >=7.15.0 makes all web3 API calls in the codebase fail at runtime. web3.py v7 removed the legacy camelCase method names in favor of snake_case. The codebase still uses the old names in multiple places:

All broken web3 API call sites
  • python/src/trezorlib/cli/ethereum.py:393 and ethereum_onekey.py:323: isConnected() → removed, now is_connected()
  • python/src/trezorlib/cli/ethereum.py:428 and ethereum_onekey.py:349: eth.estimateGas() → removed, now eth.estimate_gas()
  • python/src/trezorlib/cli/ethereum.py:438 and ethereum_onekey.py:359: eth.getTransactionCount() → removed, now eth.get_transaction_count()
  • python/src/trezorlib/cli/ethereum.py:467 and ethereum_onekey.py:410: eth.gasPrice → removed, now eth.gas_price
  • python/src/trezorlib/cli/ethereum.py:522 and ethereum_onekey.py:478: eth.sendRawTransaction() → removed, now eth.send_raw_transaction()
  • python/src/trezorlib/cli/ethereum.py:159 and ethereum_onekey.py:170: contract.encodeABI() → removed, now contract.encode_abi()

Any user who installs web3>=7.15.0 (as now required) and attempts to use the Ethereum signing/transaction commands will get AttributeError at runtime. Either the version requirement should be lowered, or all the camelCase method calls need to be updated to snake_case.

Prompt for agents 
The web3 version requirement was bumped to >=7.15.0 in requirements-optional.txt, but the Python code that uses web3 still references camelCase API methods that were removed in web3 v7. All 12 call sites across python/src/trezorlib/cli/ethereum.py and python/src/trezorlib/cli/ethereum_onekey.py need to be updated to snake_case equivalents:

- isConnected() -> is_connected()
- eth.estimateGas() -> eth.estimate_gas()
- eth.getTransactionCount() -> eth.get_transaction_count()
- eth.sendRawTransaction() -> eth.send_raw_transaction()
- eth.gasPrice -> eth.gas_price
- contract.encodeABI() -> contract.encode_abi()

Additionally, python/setup.py line 30 still has web3>=4.8 in extras_require['ethereum'] and should also be updated to match the new version requirement.

Note that web3 v7 also changed some constructor and provider behaviors, so the Web3() instantiation in _get_web3() (ethereum.py:89, ethereum_onekey.py:69) should be tested to ensure it still works as expected.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Apr 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 setup.py extras_require still specifies web3>=4.8, inconsistent with updated requirements-optional.txt

The PR updates requirements-optional.txt to require web3>=7.15.0, but python/setup.py:30 still declares "web3>=4.8" in extras_require["ethereum"]. Users installing via pip install trezor[ethereum] will get the old >=4.8 constraint from setup.py, potentially installing web3 v4/v5/v6, while users installing from requirements-optional.txt will get v7+. This inconsistency means different installation methods produce incompatible environments.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

Pillow
stellar-sdk>=4.0.0,<6.0.0
Loading