solana-foundation/solana-web3.js

this._disconnectChannel(
  SUBSCRIPTION_CHANNEL_CLOSE_CODE_UNEXPECTED,
  error instanceof Error ? error : new Error(String(error)),

When the channel cannot be created, _disconnectChannel calls onDisconnected. That marks every subscription pending and calls updateSubscriptions(), which calls ensureConnected() again straight away (controller.ts:178 and controller.ts:256-258). Nothing in this cycle waits. While the RPC endpoint is down or rate-limiting, every client with an active subscription retries in a tight loop. That adds load to the endpoint and writes a ws error: line to the log on each attempt.

Add capped exponential backoff with jitter before reconnecting after an unexpected close. Reset it after a successful connection.

transaction.signatures.some(
  keyObj => keyObj.publicKey.toString() === pubkey.toString(),
) || message.isAccountSigner(account),

• Transaction.from and Message.from accept input of any length, even though a real transaction is at most 1,232 bytes.
• For every account reference in every instruction, populate scans the whole signature list and base58-encodes both keys again on each comparison. The work grows with the number of signatures multiplied by the number of account references.
• A crafted oversized payload can block the event loop of a server that parses transactions received from users.
• Account indexes are never checked against accountKeys.length. An out-of-range index produces an unhelpful TypeError instead of a clear parse error.

Reject input larger than the protocol packet size before decoding. Check that every account index and program index is within range. Build a set of signer keys once, or compare bytes with PublicKey.equals, instead of re-encoding inside the nested loop.

(subscription.callbacks as Set<SubscriptionConfig['callback']>).delete(
  callback,
);

Callbacks are stored in a Set (see addSubscriptionCallback, line 150). If the same function is registered twice for the same account, slot or logs subscription, the caller gets two subscription ids but the set holds only one entry. Removing either id deletes that entry. The other listener stops receiving notifications without any error, and the server subscription closes. An application that shares one handler across components loses updates without knowing it.

Store callbacks per client subscription id, for example in a Map<clientId, callback>, or keep a reference count per callback. Remove entries by id.

uses: peaceiris/actions-gh-pages@v4
with:
  github_token: ${{ secrets.GITHUB_TOKEN }}

This job has contents: write. If the action's owner retags v4, or the action is compromised, arbitrary code can run with a token that can push to the repository. dessant/lock-threads, dessant/label-actions and actions/stale hold issue and pull-request write permissions and are also referenced by tag. The publish workflow already pins its actions to commit SHAs.

Pin every third-party action to a full commit SHA, and update the pins with a tool such as Dependabot.

const target = active()?.wallet;
select(null);
try {

The selection is cleared before namespace.disconnect() runs. If the disconnect is rejected, selectedName stays null while the wallet is still connected. The snapshot then shows connected = true with no selected wallet and no signIn, and connect() throws "Select a wallet before connecting". The UI ends up in a state the user cannot get out of.

Clear the selection only after the disconnect succeeds, or restore the previous selection in the catch block. A more robust option is to derive the selection from the wallet client's own state.

signal.addEventListener('abort', () => {
  reject(signal.reason);
});

An application that reuses one long-lived AbortSignal across many confirmations collects one listener and closure per call. That memory is not released until the signal is aborted or garbage-collected.

Register the listener with {once: true} and remove it in the callers' finally blocks.

() => ({connection: new Connection(endpoint, config)}),
  [endpoint, config],

A Connection owns a websocket channel and a subscription registry. A new one is created whenever endpoint or config change, and the old one is never closed. If config is passed inline, a new Connection is built on every render. That discards the blockhash cache and leaves the previous socket running.

Compare config by value before rebuilding. Give Connection a close or dispose method and call it from an effect cleanup.

else globalThis.localStorage?.setItem(key, JSON.stringify(value));

Each hook instance keeps its own copy of the value and only writes to storage. Another instance, or another tab, that writes the same key is never seen, so whichever instance writes last overwrites the stored value. The keys are chosen by the caller and have no namespace.

Subscribe to the storage event and to an in-page notifier, for example with useSyncExternalStore. Prefix the keys with an owner name.

rpcCommitment == null && minContextSlot == null
  ? this._typedRpc.getLatestBlockhash()
  : this._typedRpc.getLatestBlockhash({

_resolveCommitment always returns a value, falling back to 'confirmed' at line 3658. The many rpcCommitment == null branches therefore never run. The comment near line 6091 says the default is finalized, and sendAndConfirmTransaction falls back to finalized. Maintainers cannot tell which default is intended.

Remove the dead branches, define the default commitment in one place, and correct the comment.

export class Connection {

One class holds the blockhash cache and its polling, three confirmation strategies, the subscription facade, HTTP transport and retry, and around 130 RPC wrappers. Changes in one part are hard to review in isolation. Finding 12 shows that defaults have already drifted inside the class.

Move the blockhash cache, the confirmation strategies and the subscription facade into their own modules, and keep Connection as a thin facade.

export class StakeProgram {

State decoding, instruction decoding and instruction builders share one file of about 1,600 lines, although they have no state in common.

Split the file into state, instruction-decoding and builder modules, and re-export them from the current path.

export class Transaction {

The wire parser in this file has the problem described in finding 13. It is harder to harden while it sits inside the signing and compiling class.

Move TransactionInstruction and the wire parse and populate logic into separate modules.

while (this._pollingBlockhash) {
  await sleep(100);
}

Callers that wait check a boolean every 100 ms. If the refresh fails, each of them starts its own refresh. A call with disableCache = true runs _pollNewBlockhash directly, and when it finishes it clears the shared flag while another refresh is still running.

Keep a single in-flight promise for the refresh, return it to concurrent callers, and clear it in finally.

const {
  context: {slot: minContextSlot},
  value: {blockhash, lastValidBlockHeight},
} = await connection.getLatestBlockhashAndContext();

SendTransaction, SendLegacyTransaction, SendV0Transaction and SendV1Transaction differ only in how the message is compiled. A fix to the shared flow has to be made four times. Because this is example code, some repetition may be intentional.

Extract one shared send-and-confirm helper that takes a transaction builder.

- name: Verify install as a consumer
  run: pnpm --filter @solana/wallet-adapter run test:install

The install check packs its own tarballs, which have a different manifest. The tarballs that are actually published, built after devDependencies are removed, are only checked by inspecting the manifest and confirming that entry-point files exist. A packaging error that only appears on import could be published.

Run the install-and-import smoke test against the exact .npm-pack/*.tgz files before npm publish.

- name: Run unit tests
  run: pnpm run test:unit

The validator-backed integration tests and the browser test run in CI but not in the publish job. A release can be triggered from a commit whose CI failed.

Add the integration tests to the publish job, or require a green CI run on the release commit.

sh -c "$(curl -sSfL https://release.anza.xyz/$version/install)" init $version --data-dir $TARGET_DIR --no-modify-path

The validator version comes from an unauthenticated query for the newest GitHub release at run time. The installer is then piped straight into a shell, with no checksum or signature check. CI results therefore cannot be reproduced, and CI trusts whatever the host serves. If the version lookup fails, get-latest-validator-release-version.sh prints a Unix timestamp, and that timestamp is passed to the installer as a version, which produces a confusing failure.

Pin a known validator version in the repository and check the installer or binary against a published checksum before running it. If the version cannot be determined, fail with a clear error.

const input: SolanaSignInInput = {
  address: address ?? undefined,
  domain: window.location.host,

The sign-in request has no single-use nonce, no issuedAt and no expirationTime, and the signature is checked only in the browser. If a developer copies this pattern into a real login, an attacker who captures one signed sign-in proof can replay it indefinitely. SignMessage.tsx signs a fixed text in the same way.

Have a backend issue a single-use nonce and timestamps. Put them in the sign-in input, and verify the signature and the nonce on the server. If the component is meant only as a demo, add a comment saying it is not a complete authentication flow.

const controller = createWalletController({
  ...options,
  onError: (error, adapter) => errorRef.current?.(error, adapter),

Some browser wallets refuse to connect from a plain-HTTP origin other than localhost, and they fail without a clear message. I searched the provider and the example app for isSecureContext and location.protocol and found neither. The developer therefore sees an unexplained connection failure.

Before connecting, check window.isSecureContext. If it is false, report a clear error through onError, for example "Serve this page over HTTPS".

sleep(2000),
cancellationPromise.catch(() => cancellationSentinel),

Each confirmation polls the nonce account every 2 seconds, and block-height-based confirmation polls getBlockHeight every second, once per call. An account-change subscription already exists in the library. With many concurrent confirmations, the RPC traffic grows linearly with the number of confirmations.

Use an account subscription on the nonce account and fall back to polling only if the subscription fails. Share one block-height poller across concurrent confirmations.

static default: Lockup = new Lockup(0, 0, PublicKey.default);

StakeProgram.initialize falls back to Lockup.default (line 1106). If any code changes its fields, every later stake initialization in the process uses the changed lockup, and new stake accounts could be locked without anyone noticing.

Return a new, frozen Lockup from a getter, or make the fields readonly and freeze the instance.

await namespace.connect(target);

If the user double-clicks or taps repeatedly, each tap starts a new connect request and the earlier request is aborted. The wallet prompt can then reopen, and earlier callers receive a "superseded" rejection.

Keep the pending connect promise and return it until it settles.

console.error('ws error:', normalizedError.message);

About nine direct console.error calls are spread across registry.ts, controller.ts and runtime.ts, and the same message is logged at two sites. Applications cannot silence or rate-limit these logs, which matters during the reconnect loop described in finding 3.

Route these calls through one internal logger that applications can configure.