CVE-2021-39168: TimelockController vulnerability in OpenZeppelin Contracts
Summary
CVE-2021-39168: TimelockController vulnerability in OpenZeppelin Contracts. Affects @openzeppelin/contracts-upgradeable across 2 version ranges.
>= 3.3.0, < 3.4.2
>= 4.0.0, < 4.3.1
Fixed in 3.4.2 or 4.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenZeppelin Contracts is an open-source library of reusable smart contracts for Ethereum. It provides a collection of secure and audited contracts that developers can use to build decentralized applications (dApps) and smart contracts. One of the contracts provided by OpenZeppelin Contracts is the TimelockController, which allows for delayed execution of transactions. This contract is used to enforce a delay period before certain actions can be executed, providing a time window for review and intervention if necessary.
Vulnerability Detail
The TimelockController contract in OpenZeppelin Contracts had a vulnerability that allowed an actor with the executor role to take immediate control of the timelock. By resetting the delay to 0 and escalating privileges, the attacker could gain unrestricted access to assets held in the contract. This vulnerability affected instances where the executor role was set to "open", allowing anyone to use the executor role and leaving the timelock at risk of being taken over. The impact of this vulnerability is critical, as it could result in unauthorized access to and manipulation of assets stored in the contract.
How To Fix
Latest published version: 5.6.1 as of 22 Oct 2026
npm install @openzeppelin/contracts-upgradeable@5.6.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.3.0, < 3.4.23.4.2npm install @openzeppelin/contracts-upgradeable@3.4.2 -
>= 4.0.0, < 4.3.14.3.1npm install @openzeppelin/contracts-upgradeable@4.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is recommended to revoke the executor role from accounts that are not strictly under the team's control. This can be done by modifying the contract's configuration to remove the executor role from unauthorized accounts. However, it is important to ensure that at least one proposer and executor remain after applying this mitigation.
Conclusion
The TimelockController vulnerability in OpenZeppelin Contracts is a critical issue that allows an attacker to gain unrestricted access to assets. It is crucial for developers using the TimelockController contract to update to the patched versions provided by OpenZeppelin. Replacing the deployed instances and following the recommended migration process will ensure the security of the contract and prevent unauthorized access. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for @openzeppelin/contracts-upgradeable →
FAQ
The impact of this vulnerability is critical, as it allows an attacker to gain unrestricted access to assets held in the TimelockController contract.
To fix this vulnerability, you need to replace the deployed instances of the TimelockController contract with the fixed version by migrating all assets, ownership, and roles.
Yes, you can revoke the executor role from unauthorized accounts as a temporary workaround. However, ensure that at least one proposer and executor remain after applying this mitigation.
The vulnerability affects versions 3.3.0 to 3.4.2 and 4.0.0 to 4.3.0 of @openzeppelin/contracts-upgradeable.
The vulnerability was identified by an anonymous white hat hacker through Immunefi.
References
Related vulnerabilities
Recent vulnerabilities recorded for @openzeppelin/contracts-upgradeable.
