GHSA-3jcg-vx7f-j6qf The fuels-ts typescript SDK has no awareness of to-be-spent transactions

• npm @fuel-ts/account: < 0.93.0 → fixed in 0.93.0

Brief/Intro The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs. The `Typescript SDK` provides the `fund` function which retrieves `UTXOs`, which belong to the owner and can be used to fund the request in question, from fuel's graphql api. These then get added to the request making it possible to send it to the network as it now has inputs which can be spent by its outputs. Now this works when a user only wants to fund one transaction per block as in the next block, the spent UTXO will not exist anymore. However if a user wants to fund multiple transactions within one block, the following can happen: It is important to note, that the graphql API will return a random UTXO which has enough value to fund the transaction in question. • user has 2 spendable `UTXOs` in their wallet which can cover all expenses • user funds transaction `tA` with an input gotten from the API `iA` • user submits `tA` to fuel • `iA` is still in possession of the user as no new block has been produced • user funds a transaction `tB` and gets the same input `iA` from the API • user tries to submit transaction `tB` to fuel but now one of the following can happen: • if the recipient and all other parameters are the same as in `tA`, submission will fail as `tB` will have the same `txHash` as `tA` • if the parameters are different, there will be a collision in the `txpool` and `tA` will be removed from the `txpool` Vulnerability Details The problem occurs, because the `fund` function in `fuels-ts/packages/account/src/account.ts` gets the needed ressources statelessly with the function `getResourcesToSpend` without taking into consideration already used UTXOs: ```ts async fund(request: T, params: EstimatedTxParams): Promise { // [...] let missingQuantities: CoinQuantity[] = []; Object.entries(quantitiesDict).forEach(([assetId, { owned, required }]) => { if (owned.lt(required)) { missingQuantities.push({ assetId, amount: required.sub(owned), }); } }); let needsToBeFunded = missingQuantities.length > 0; let fundingAttempts = 0; while (needsToBeFunded && fundingAttempts new Promise((resolve) => setTimeout(resolve, ms)); console.log("Balance wallet before: ", await wallet.getBalance()); console.log("Balance wallet2 before: ", await wallet2.getBalance()); wallet2.transfer(wallet.address, 100); await sleep(5500); await wallet.transfer(wallet2.address, 80); console.log('wallet -> wallet2'); await wallet.transfer(wallet2.address, 80); console.log('wallet -> wallet2'); console.log("Balance wallet after: ", await wallet.getBalance()); console.log("Balance wallet2 after: ", await wallet2.getBalance()); }; executeTransaction().catch(console.error); ```