CVE-2021-41264: UUPSUpgradeable vulnerability in @openzeppelin/contracts
Summary
CVE-2021-41264: UUPSUpgradeable vulnerability in @openzeppelin/contracts. Affects @openzeppelin/contracts versions >= 4.1.0, < 4.3.2. Fixed in 4.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @openzeppelin/contracts package is an open-source library for building secure and upgradeable smart contracts on the Ethereum blockchain. It provides a set of reusable Solidity contracts that implement common functionality and best practices. The UUPSUpgradeable contract is used for creating upgradeable contracts, allowing developers to easily update the contract's logic without disrupting its state or deployed instances. However, a vulnerability has been discovered in the UUPSUpgradeable contract that could lead to uninitialized implementation contracts.
Vulnerability Detail
The UUPSUpgradeable vulnerability in @openzeppelin/contracts allows uninitialized implementation contracts to be exploited. Upgradeable contracts using UUPSUpgradeable are affected by this vulnerability. An attacker could potentially take advantage of uninitialized implementation contracts to manipulate the contract's behavior and compromise its security. The impact of this vulnerability can vary depending on the specific implementation and usage of the affected contracts.
How To Fix
Minimum fixed version
4.3.2
This is the first release that contains the fix.
npm install @openzeppelin/contracts@4.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to manually initialize the implementation contracts using the initializer function. Developers can refer to the example provided in the OpenZeppelin forum for guidance on how to properly initialize UUPSUpgradeable implementation contracts.
Conclusion
The UUPSUpgradeable vulnerability in @openzeppelin/contracts can pose a significant risk to upgradeable contracts using this package. It is crucial for developers to update to the fixed versions and ensure proper initialization of implementation contracts. Failure to address this vulnerability can result in unauthorized manipulation of contract behavior and compromise the security of the smart contract application. For further assistance and support in remediating this vulnerability, please contact DevNack.com.
See every vulnerability recorded for @openzeppelin/contracts →
FAQ
The UUPSUpgradeable vulnerability can allow attackers to exploit uninitialized implementation contracts in upgradeable contracts. This can potentially lead to unauthorized manipulation of the contract's behavior and compromise its security.
To fix the UUPSUpgradeable vulnerability, update to version 4.3.2 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. Additionally, ensure that all implementation contracts are properly initialized using the initializer function.
No, only versions 4.1.0 to 4.3.1 of @openzeppelin/contracts are affected by the UUPSUpgradeable vulnerability. Updating to version 4.3.2 or later will fix the vulnerability.
Yes, a workaround is to manually initialize the implementation contracts using the initializer function. Refer to the OpenZeppelin forum for an example of how to properly initialize UUPSUpgradeable implementation contracts.
For more information about the UUPSUpgradeable vulnerability, refer to the post-mortem and advisory provided by OpenZeppelin. Links to these resources can be found in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for @openzeppelin/contracts.
