CVE-2023-49798: OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4
Summary
CVE-2023-49798: OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4. Affects @openzeppelin/contracts versions >= 4.9.4, < 4.9.5. Fixed in 4.9.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenZeppelin Contracts is an open-source library of reusable smart contracts for Ethereum. It provides a collection of secure and audited contracts that developers can use to build decentralized applications (dApps) and smart contracts. OpenZeppelin Contracts Upgradeable is an extension of OpenZeppelin Contracts that allows for upgradability of smart contracts. The library is widely used in the Ethereum ecosystem.
The vulnerability identified in version 4.9.4 of both OpenZeppelin Contracts and Contracts Upgradeable involves the execution of subcalls. Due to a merge conflict resolution issue during the porting of the v5.0.1 Multicall update to the v4.9 branch, a line of code was duplicated. This duplication causes each subcall to be executed twice, potentially leading to unintended duplicate operations such as asset transfers.
Vulnerability Detail
The vulnerability arises from the duplicated execution of subcalls in versions 4.9.4 of OpenZeppelin Contracts and Contracts Upgradeable. When using the Multicall feature from these versions, each subcall is executed twice, exposing users to unintentional duplicate operations. This can have various ramifications, including incorrect asset transfers and unexpected behavior in smart contracts. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Minimum fixed version
4.9.5
This is the first release that contains the fix.
npm install @openzeppelin/contracts@4.9.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to version 4.9.5 of OpenZeppelin Contracts and Contracts Upgradeable.
Conclusion
The vulnerability in OpenZeppelin Contracts and Contracts Upgradeable version 4.9.4 involves the duplicated execution of subcalls, which can lead to unintended duplicate operations. To mitigate this vulnerability, it is crucial to upgrade to version 4.9.5 of the affected packages. Developers should update their dependencies and recompile their smart contracts to ensure the fix is applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @openzeppelin/contracts →
FAQ
OpenZeppelin Contracts is an open-source library of reusable smart contracts for Ethereum. It provides a collection of secure and audited contracts that developers can use to build decentralized applications (dApps) and smart contracts.
OpenZeppelin Contracts Upgradeable is an extension of OpenZeppelin Contracts that allows for upgradability of smart contracts. It provides additional functionality to enable seamless upgrades of deployed contracts.
The Multicall feature allows for batching multiple function calls into a single transaction, reducing gas costs and improving efficiency. It is a commonly used feature in smart contract development.
The vulnerability can lead to unintended duplicate operations, such as asset transfers. This can result in incorrect balances, unexpected behavior in smart contracts, and potential financial losses.
The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @openzeppelin/contracts.
