CVE-2021-39167: TimelockController vulnerability in OpenZeppelin Contracts
Summary
CVE-2021-39167: TimelockController vulnerability in OpenZeppelin Contracts. Affects @openzeppelin/contracts across 2 version ranges.
>= 3.3.0, < 3.4.2
>= 4.0.0, < 4.3.1
Fixed in 3.4.2 or 4.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenZeppelin Contracts is an open-source library of reusable smart contracts for Ethereum. It provides a collection of secure and audited contracts that developers can use to build decentralized applications (dApps) and smart contracts. One of the contracts provided by OpenZeppelin Contracts is the TimelockController, which allows for delayed execution of administrative actions. However, a vulnerability has been discovered in the TimelockController that could allow an attacker to take immediate control of the timelock and gain unrestricted access to assets held in the contract.
Vulnerability Detail
The vulnerability in the TimelockController allows an actor with the executor role to reset the delay to 0 and escalate privileges, effectively taking over the timelock. This vulnerability can be exploited when the executor role is set to "open", which allows anyone to use the executor role. By taking control of the timelock, the attacker can bypass any time delays and gain unrestricted access to the assets held in the contract. This can lead to unauthorized transfers or modifications of assets, potentially resulting in financial loss or disruption of the affected smart contracts.
How To Fix
Latest published version: 5.6.1 as of 23 Oct 2026
npm install @openzeppelin/contracts@5.6.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.3.0, < 3.4.23.4.2npm install @openzeppelin/contracts@3.4.2 -
>= 4.0.0, < 4.3.14.3.1npm install @openzeppelin/contracts@4.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A workaround for this vulnerability is to revoke the executor role from accounts that are not strictly under the team's control. This can be done by modifying the contract's configuration to remove the executor role from unauthorized accounts. However, it is important to ensure that there is at least one proposer and executor remaining to maintain the functionality of the TimelockController.
Conclusion
The TimelockController vulnerability in OpenZeppelin Contracts can allow an attacker to take immediate control of the timelock and gain unrestricted access to assets held in the contract. To mitigate this vulnerability, developers should update their dependencies to the fixed versions of the @openzeppelin/contracts library and replace deployed instances of the TimelockController. Additionally, revoking the executor role from unauthorized accounts can provide a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @openzeppelin/contracts →
FAQ
The vulnerability allows an attacker to take immediate control of the TimelockController and gain unrestricted access to assets held in the contract. This can lead to unauthorized transfers or modifications of assets, potentially resulting in financial loss or disruption of the affected smart contracts.
To fix this vulnerability, you should update your dependencies to one of the fixed versions of the @openzeppelin/contracts library: 4.3.1, 3.4.2, or 3.4.2-solc-0.7. Additionally, you should replace deployed instances of the TimelockController with the fixed version by migrating all assets, ownership, and roles.
Yes, a workaround for this vulnerability is to revoke the executor role from accounts that are not strictly under your team's control. However, it is important to ensure that there is at least one proposer and executor remaining to maintain the functionality of the TimelockController.
The vulnerability was identified by an anonymous white hat hacker through Immunefi, a platform for coordinating vulnerability disclosures and bug bounties.
You can find more information about this vulnerability in the post-mortem report provided by OpenZeppelin: https://forum.openzeppelin.com/t/timelockcontroller-vulnerability-postmortem/14958.
References
Related vulnerabilities
Recent vulnerabilities recorded for @openzeppelin/contracts.
