Brief/Intro The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs. The Typescript SDK provides the fund function which retrieves UTXOs, which belong to the owner and can be used to fund the request in question, from fuel's graphql api. These then get added to the request making it possible to send it to the network as it now has inputs which can be spent by its outputs. Now this works when a user only wants to fund one transaction per block as in the next block, the spent UTXO will not exist anymore. However if a user wants to fund multiple transactions within one block, the following can happen: It is important to note, that the graphql API will return a random UTXO which has enough value to fund the transaction in question. user has 2 spendable UTXOs in their wallet which can cover all expenses user funds transaction tA with an input gotten from the API iA user submits tA to fuel iA is still in possession of the user as no new block has been produced user funds a transaction tB and gets the same input iA from the API user tries to submit transaction tB to fuel but now one of the following can happen: if the recipient and all other parameters are the same as in tA, submission will fail as tB will have the same txHash as tA if the parameters are different, there will be a collision in the txpool and tA will be removed from the txpool Vulnerability Details The…Read More