AIKIDO-2025-10895

TL;DR

Affected versions of this package contain an integer overflow, where the Transaction.value field is typed as number in TypeScript, but JavaScript's Number type cannot safely represent integers above 2^53-1, causing large wei values from API responses to overflow into incorrect or negative numbers during JSON parsing. An attacker can exploit this by crafting orders with sufficiently large values that exceed the safe integer limit, leading to an overflow and a negative parsed value, which may result in underpayment, unintended transaction execution, or financial loss due to misinterpreted values in the fulfillOrder function.