Crash in Adyen 3DS2 SDK on Android 13 (NullPointerException in getMessageVersion during ChallengeActivity launch)

[ukatore]

Description

A crash was observed in the production environment with the following details:

1. Caused by java.lang.NullPointerException: null receiver
   at java.lang.reflect.Method.invoke(Method.java)
   at atd.e.getMessageVersion.(getMessageVersion.java:4000)
   at atd.e.getMessageVersion.AuthenticationRequestParameters(getMessageVersion.java:65352)
   at com.adyen.threeds2.internal.ui.activity.ChallengeActivity.b(SourceFile:195)
   at com.adyen.threeds2.internal.ui.activity.ChallengeActivity.(SourceFile:65)
   at java.lang.Class.newInstance(Class.java)
   at android.app.AppComponentFactory.instantiateActivity(AppComponentFactory.java:95)
   at androidx.core.app.CoreComponentFactory.instantiateActivity(CoreComponentFactory.java:44)
   at android.app.Instrumentation.newActivity(Instrumentation.java:1339)
   at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:3538)
   at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:3782)
   at android.app.servertransaction.LaunchActivityItem.execute(LaunchActivityItem.java:101)
   at android.app.servertransaction.TransactionExecutor.executeCallbacks(TransactionExecutor.java:135)
   at android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:95)
   at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2307)
   at android.os.Handler.dispatchMessage(Handler.java:106)
   at android.os.Looper.loopOnce(Looper.java:201)
   at android.os.Looper.loop(Looper.java:288)
   at android.app.ActivityThread.main(ActivityThread.java:7872)
   at java.lang.reflect.Method.invoke(Method.java)
   at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
   at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:936)

2. Fatal Exception: java.lang.ExceptionInInitializerError:
   at java.lang.Class.newInstance(Class.java)
   at android.app.AppComponentFactory.instantiateActivity(AppComponentFactory.java:95)
   at androidx.core.app.CoreComponentFactory.instantiateActivity(CoreComponentFactory.java:44)
   at android.app.Instrumentation.newActivity(Instrumentation.java:1339)
   at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:3538)
   at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:3782)
   at android.app.servertransaction.LaunchActivityItem.execute(LaunchActivityItem.java:101)
   at android.app.servertransaction.TransactionExecutor.executeCallbacks(TransactionExecutor.java:135)
   at android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:95)
   at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2307)
   at android.os.Handler.dispatchMessage(Handler.java:106)
   at android.os.Looper.loopOnce(Looper.java:201)
   at android.os.Looper.loop(Looper.java:288)
   at android.app.ActivityThread.main(ActivityThread.java:7872)
   at java.lang.reflect.Method.invoke(Method.java)
   at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
   at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:936)

3. Caused by java.lang.RuntimeException: java.lang.NullPointerException: null receiver
   at atd.e.getMessageVersion.(getMessageVersion.java:48)
   at atd.e.getMessageVersion.AuthenticationRequestParameters(getMessageVersion.java:65352)
   at com.adyen.threeds2.internal.ui.activity.ChallengeActivity.b(SourceFile:195)
   at com.adyen.threeds2.internal.ui.activity.ChallengeActivity.(SourceFile:65)
   at java.lang.Class.newInstance(Class.java)
   at android.app.AppComponentFactory.instantiateActivity(AppComponentFactory.java:95)
   at androidx.core.app.CoreComponentFactory.instantiateActivity(CoreComponentFactory.java:44)
   at android.app.Instrumentation.newActivity(Instrumentation.java:1339)
   at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:3538)
   at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:3782)
   at android.app.servertransaction.LaunchActivityItem.execute(LaunchActivityItem.java:101)
   at android.app.servertransaction.TransactionExecutor.executeCallbacks(TransactionExecutor.java:135)
   at android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:95)
   at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2307)
   at android.os.Handler.dispatchMessage(Handler.java:106)
   at android.os.Looper.loopOnce(Looper.java:201)
   at android.os.Looper.loop(Looper.java:288)
   at android.app.ActivityThread.main(ActivityThread.java:7872)
   at java.lang.reflect.Method.invoke(Method.java)
   at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
   at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:936)

Additional Information

Device Information :
Android Device - Nexus 5X
Android OS - 13

Do we need to apply any specific ProGuard / R8 rules for the Adyen SDK?

If yes, could you please provide the recommended rules?

[ozgur00]

Hi @ukatore! Thanks for reaching out to us. Can you share which version of our SDK you're using for us to investigate the issue better?

[ukatore]

Hello getting issue for 5.12.0 version

[ukatore]

@ozgur00 any progress in issue.

[tkuntubayev]

Hi @ukatore,
After the initial investigation we could conclude that the issue might be caused by different reasons including one of the expected behavior when the SDK protects itself against dynamic tampering that leads to this type of "crashes". To be able to investigate further we'd like to request additional information:

• steps to reproduce the issue (if known)
• is the issue occurs at the initial start of the Challenge or at some point later (e.g. after orientation change, restoring after a process kill)
• frequency of the issue
• affected Android versions
• any patterns in device manufacturer or device model
• any patterns regarding the timeframes when the issues were reported

[ukatore]

Hello @tkuntubayev

Issue Captured via Firebase Crashlytics We have below information:

Frequency: 3 events reported across 2 unique users

Affected Android Version: Android 13

Device Pattern: All occurrences reported on Nexus 5X devices

Timeframe Correlation: Issues began occurring after updating to Adyen SDK version 5.12.0

[tkuntubayev]

Hi @ukatore,
After many attempts I couldn't reproduce the issue using the provided info or find any other unexpected reason for it to happen. Given that the number of occurrences is low and device pattern pointing to the same device model and only 2 unique users, this suggests that the SDK takes measures to protect itself against tampering. If you'd find any other info that shed more light, please feel free to share with us.

[github-actions]

This issue is now stale because it has been open for 14 days with no activity. Please provide the requested information or the issue will be closed automatically.

[JakeSteam]

Just confirming that on our app (Adyen drop-in & component, v5.11.0) we've experienced it 3x in the last 90 days, always on Android 13 Nexus 5X. The stats report 3 different users, but they all have almost identical RAM & disk usage so these are likely just fresh emulators.

The crash happens on our login screen after unusual & repetitive navigation around the pre-auth area, long before any payment process starts. I suspect the conclusion about it being a response to tampering is correct.

It would be nice if the crash didn't show up in our Crashlytics logs, but that's not exactly a priority!

[tkuntubayev]

@JakeSteam, thanks for the additional valuable input. Since the issue has so far occurred once per app version under the same emulator setup, do you notice any time correlation with release timelines - for example, crashes appearing shortly after a new version is uploaded? Given the consistent occurrence pattern and specific device model, it seems that these events might be related to automated randomized checks performed during the app publishing process.

[JakeSteam]

@tkuntubayev Looks like you're onto something. We typically released to 5-10% for the first 24hr, so the crash happens after passing Google approval, yet whilst only accessible to a small group of users.

Perhaps some post-release Google testing, or a third party scanning for vulnerabilities (we've been targeted by automated fraud multiple times).

• 4.9.4: Released 5 Aug, crashed 6 Aug
• 4.9.7: Released 26 Sep, crashed 27 Sept
• 4.9.9: Released 14 Oct, crashed 15 Oct

[tkuntubayev]

@JakeSteam since there's a connection with release timelines, there’s a strong possibility it’s related to Google Play’s Pre-launch report generation, which runs various automated tests on a new version of your app:

If that’s the case, you can find the relevant stack traces and additional logs by following the steps in the “View pre-launch report details” section of the Google Play help page:
https://support.google.com/googleplay/android-developer/answer/9842757

These details could help us understand whether the issue is indeed connected to the SDK's self-protection mechanisms and whether we can do anything about it.