Inconsistent storage layout for ERC2771ContextUpgradeable in @openzeppelin/contracts-upgradeable
Summary
GHSA-7j52-6fjp-58gr: Inconsistent storage layout for ERC2771ContextUpgradeable. Affects @openzeppelin/contracts-upgradeable versions >= 4.0.0, < 4.3.0. Fixed in 4.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @openzeppelin/contracts-upgradeable package is an open-source library that provides upgradeable smart contract functionality for Ethereum-based applications. It includes various contract templates and utilities to facilitate contract upgrades and maintenance. One of the contracts in this package is ERC2771ContextUpgradeable, which is used for implementing the ERC2771 standard for gasless transactions. This vulnerability affects versions 4.0.0 to 4.2.0 of the package.
Vulnerability Detail
The vulnerability arises from an inconsistent storage layout in the ERC2771ContextUpgradeable contract. In versions 4.0.0, 4.1.0, and 4.2.0, the contract has a length of 51 slots, while in version 4.3.0 and onwards, it has a length of 50 slots. This difference in layout can lead to breaking upgrades if a contract using ERC2771ContextUpgradeable <4.3.0 is upgraded to a newer version that uses >=4.3.0. The risk of breaking upgrades can cause issues in the functionality and stability of the upgraded contract.
How To Fix
Latest published version: 5.6.1 as of 22 Oct 2026
npm install @openzeppelin/contracts-upgradeable@5.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.3.0
This is the first release that contains the fix.
npm install @openzeppelin/contracts-upgradeable@4.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A possible workaround for this vulnerability is to copy the previous implementation of ERC2771ContextUpgradeable from the release-4.2 branch and include it in your codebase. This ensures that the storage layout remains consistent and avoids potential breaking upgrades.
Conclusion
In summary, the @openzeppelin/contracts-upgradeable package has a vulnerability related to the inconsistent storage layout of the ERC2771ContextUpgradeable contract. Upgrading from a contract using ERC2771ContextUpgradeable <4.3.0 to a newer version that uses >=4.3.0 can result in breaking upgrades. To mitigate this vulnerability, it is recommended to be cautious during upgrades, use the OpenZeppelin Upgrades Plugins, and consider copying the previous implementation of ERC2771ContextUpgradeable if necessary. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @openzeppelin/contracts-upgradeable →
FAQ
The impact of this vulnerability is the potential for breaking upgrades when upgrading from a contract that uses ERC2771ContextUpgradeable <4.3.0 to a newer version that uses >=4.3.0. This can result in issues with the functionality and stability of the upgraded contract.
To mitigate the risk of breaking upgrades, it is recommended to be extremely careful when upgrading from a contract that uses ERC2771ContextUpgradeable <4.3.0 to a newer version that uses >=4.3.0. Additionally, using the OpenZeppelin Upgrades Plugins for Hardhat and Truffle can help catch potentially breaking upgrades.
If you need to upgrade to a newer version of the Upgradeable Contracts library, it is recommended to copy the previous implementation of ERC2771ContextUpgradeable from the release-4.2 branch and package it with your code. This ensures that the storage layout remains consistent and avoids potential breaking upgrades.
Yes, the OpenZeppelin Upgrades Plugins for Hardhat and Truffle can help with upgrades and catch potentially breaking upgrades. It is recommended to use this tooling for all your upgrades.
You can find more information about this vulnerability in the GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-7j52-6fjp-58gr/GHSA-7j52-6fjp-58gr.json
References
Related vulnerabilities
Recent vulnerabilities recorded for @openzeppelin/contracts-upgradeable.
