[Snyk] Fix for 3 vulnerabilities

[ryanoolala]

Snyk has created this PR to fix 3 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Improper Handling of Unicode Encoding SNYK-JS-TAR-15038581	713
	Use of a Cryptographic Primitive with a Risky Implementation SNYK-JS-ELLIPTIC-14908844	708
	Prototype Pollution SNYK-JS-LODASH-15053838	631

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

[Copilot]

Pull request overview

This PR is an automated Snyk fix that updates several npm dependencies to remediate reported vulnerabilities (notably in lodash, tar, and elliptic via transitive deps). The key impact is a major version upgrade of web3 and related Ethereum tooling libraries.

Changes:

• Bump ethereumjs-tx from ^1.3.3 to ^2.1.2 and ethereumjs-util from ^5.1.2 to ^5.2.1.
• Bump lodash from ^4.17.4 to ^4.17.23 to address prototype pollution.
• Upgrade web3 from 1.0.0-beta.37 to 4.0.1 and align web3-core-helpers, web3-core-method, and web3-utils to 1.6.0.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Upgrading web3 from 1.0.0-beta.37 to 4.0.1 is a major breaking change and the current codebase still relies on v1-style APIs (e.g. web3.toWei/web3.fromWei, callback-based web3.eth.getBalance/getBlockNumber, web3.eth.personal.getAccounts, web3.currentProvider.sendAsync, and web3.currentProvider.rpcEngine._middleware in src/utils/ethutil.js, scripts/deploy_contracts.js, and test/utils/TestUtils.js). With these lines as-is, the front-end and some tests are very likely to break at runtime when built against web3 v4; either the web3 upgrade should be deferred or the codebase should be updated and tested to match the v4 API surface before merging.

Suggested change

	"web3": "4.0.1",
	"web3": "1.6.0",

[Copilot]

These dependency upgrades change the resolved versions in package.json but package-lock.json (and yarn.lock, which is also present in the repo) are not updated, so installs will continue to use the old, potentially vulnerable versions until the lockfiles are regenerated. Before merging, please run the appropriate install/lockfile update (e.g. npm install or npm update and, if Yarn is used, yarn install) and commit the updated lockfile(s) so that builds are reproducible and actually pick up the patched versions.

[Copilot]

ethereumjs-tx is being upgraded here but it does not appear to be imported or required anywhere in the codebase (search_dir shows only ethereumjs-util is used). If this package is truly unused, it would be cleaner to remove it altogether rather than keep an unnecessary dependency, which slightly increases install time and the project’s attack surface.

Suggested change

"ethereumjs-tx": "^2.1.2",

[Copilot]

The direct dependencies web3-core-helpers, web3-core-method, and web3-utils are bumped to 1.6.0 while web3 itself is set to 4.0.1, and none of these core packages are imported directly in the codebase. This mix of major versions within the same library family is confusing and unnecessary; unless you explicitly depend on these internals, consider removing them as direct dependencies and relying on web3 alone to avoid version skew and simplify maintenance.

Suggested change

	"web3-core-helpers": "1.6.0",
	"web3-core-method": "1.6.0",
	"web3-utils": "1.6.0",