[Android] NullPointerException for com.adyen.threeds2.internal.dispatchDisplayHint

[StefanWallin]

Describe the bug
The crash is caused by a NullPointerException in the dispatchDisplayHint.java file, specifically in the static initializer ( <clinit> ) of the com.adyen.threeds2.internal.dispatchDisplayHint class, it's reported as line 3000, but not sure how accurate that is. The exception message "null receiver" indicates that an attempt was made to access a field or method of a null object.

This crash is likely due to a problem with the initialization of the dispatchDisplayHint class. I've thus far had 4 users with a total of 4 events. This is in less than 24 hours running Adyen-React-Native 2.4.1. All crashes have used Nexus 5X and Android 13.

To Reproduce
Steps to reproduce the behavior:

• Unknown, got this through crash reporting

Expected behavior
I expect NPE's to be guarded against. And input validation for the usage of the APIs you provide to error in development rather than throw NPE's in production if something is missing on our end.

Screenshots

Variant 1

Variant 2

Smartphone:

• Device: Nexus 5X
• OS: Android 13
• Browser: Not relevant
• Adyen RN Version: After upgrade from 2.2.0 to 2.4.1

Additional context

Crash times are eerily similar, as if triggered by something happening in the Adyen Online environment running a cron job every 12 hours: Update 2025-01-21: No longer relevant, it occurs on all possible times.

• Nov 22, 2024, 1:58:17 AM
• Nov 22, 2024, 1:58:03 AM
• Nov 21, 2024, 1:56:51 PM
• Nov 21, 2024, 1:56:37 PM

[descorp]

Hey @StefanWallin

Thanks you for your feedback! 💚

We have reported this to Android 3DS team.

So far, our theory that this is caused by obfuscation tool we use.
We will keep monitoring and I will keep you posted!

[StefanWallin]

Status? During these two months my relatively small app, with only roughly 2000 installs, has seen 12 crashes from this issue, still 100% of the users are on Nexus 5X and Android 13.

83% of crash events for this issue happened in the first 5 seconds of a user's session

[descorp]

Hey @StefanWallin

I apologize for the delay in my response.
After further investigation, our 3DS team, along with the obfuscation tool team, determined that the observed behavior was likely due to external interference. The crash can be attributed to the SDK's defensive mechanism reacting to potential malicious tampering.

Regular penetration tests of 3DS SDK prove it to be secure, however I would advice you stay vigilant.
Please report to support@adyen.com any suspicious transactions or activity.

Thank you! 💚

[descorp]

I am going to close this issue.
Feel free to continue discussion here