ERC1155Supply vulnerability in OpenZeppelin Contracts
Summary
GHSA-wmpv-c2jp-j2xg: ERC1155Supply vulnerability in OpenZeppelin Contracts. Affects @openzeppelin/contracts versions >= 4.2.0, < 4.3.3. Fixed in 4.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenZeppelin Contracts is an open-source library of reusable smart contracts for the Ethereum blockchain. It provides a set of secure and audited contracts that developers can use to build decentralized applications (dApps) and smart contracts. One of the contracts provided by OpenZeppelin Contracts is ERC1155, which is a standard for multi-token contracts. ERC1155Supply is an extension of ERC1155 that allows for tracking the total supply of tokens. However, a vulnerability has been discovered in the implementation of ERC1155Supply, which can lead to inconsistencies in the reported total supply of tokens.
Vulnerability Detail
The vulnerability occurs when ERC1155 tokens are minted. According to the ERC1155 specification, a callback is invoked on the receiver of the tokens when they are minted. However, when the ERC1155Supply extension is used, the total supply is not updated until after the callback. This means that during the callback, the reported total supply is lower than the actual number of tokens in circulation. This inconsistency can be exploited by an attacker who mints tokens and invokes a system that relies on accurate supply information. The attacker can do this after receiving the token balance but before the supply is updated, potentially leading to unauthorized actions or exploits.
How To Fix
Minimum fixed version
4.3.3
This is the first release that contains the fix.
npm install @openzeppelin/contracts@4.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If accurate supply information is crucial for a system, a workaround is to avoid minting tokens to untrusted receivers. By only minting tokens to trusted addresses, the risk of an attacker exploiting the supply inconsistency is mitigated. This workaround can be implemented by adding additional checks and validations before minting tokens or by implementing a whitelist of trusted addresses.
Conclusion
The ERC1155Supply vulnerability in OpenZeppelin Contracts can lead to inconsistencies in the reported total supply of tokens, which can be exploited by attackers. To mitigate this vulnerability, developers should update their usage of the OpenZeppelin Contracts library to version 4.3.3 or higher. Additionally, if accurate supply information is crucial, minting tokens should be restricted to trusted addresses. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @openzeppelin/contracts →
FAQ
OpenZeppelin Contracts is an open-source library of reusable smart contracts for the Ethereum blockchain. It provides a set of secure and audited contracts that developers can use to build decentralized applications (dApps) and smart contracts.
ERC1155 is a standard for multi-token contracts on the Ethereum blockchain. It allows for the creation and management of multiple types of tokens within a single contract.
ERC1155Supply is an extension of ERC1155 that allows for tracking the total supply of tokens. It provides functions and events to manage and monitor the supply of tokens within a contract.
If a system relies on accurate supply information, an attacker can exploit the supply inconsistency to mint tokens and invoke the system before the supply is updated. This can lead to unauthorized actions or exploits within the system.
This vulnerability was identified and reported by ChainSecurityAudits, a security auditing firm specializing in blockchain technologies.
References
Related vulnerabilities
Recent vulnerabilities recorded for @openzeppelin/contracts.
