fix: block alchemy_ prefixed methods#2990
Merged
grothem merged 1 commit intoMay 22, 2026
Merged
Conversation
Linked FindingsAAV-14 JSON-RPC Method Injection via /api/rpc-proxy
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
📦 Next.js Bundle Analysis for aave-uiThis analysis was generated by the Next.js Bundle Analysis action. 🤖
|
| Page | Size (compressed) |
|---|---|
global |
1.15 MB (🟡 +77 B) |
Details
The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.
Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis
If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!
mgrabina
approved these changes
May 21, 2026
grothem
approved these changes
May 22, 2026
grothem
deleted the
fix/aav-14-json-rpc-method-injection-via-api-rpc-proxy
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/api/rpc-proxyrequest whosemethodis missing, non-string, or starts withalchemy_, so callers can't use the proxy to hit Alchemy-only RPCsTest plan
curl -X POST .../api/rpc-proxy -d '{"chainId":1,"method":"alchemy_getTokenBalances","params":[...]}'returns 400{"error":"Method not allowed"}curl -X POST .../api/rpc-proxy -d '{"chainId":1,"method":"eth_blockNumber","params":[]}'still returns a block number