CVE-2023-23940 OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass

2023-02-0319:43:11

CWE-345

CWE-347

GitHub_M

www.cve.org

openzeppelin

cairo

starknet

zk rollup

signature validation

malicious sequencer

ethaccount

vulnerability

patch.

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

0.001 Low

EPSS

Percentile

26.7%

JSON

OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. is_valid_eth_signature is missing a call to finalize_keccak after calling verify_eth_signature. As a result, any contract using is_valid_eth_signature from the account library (such as the EthAccount preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.

CNA Affected

[
  {
    "vendor": "OpenZeppelin",
    "product": "cairo-contracts",
    "versions": [
      {
        "version": ">= 0.2.0, < 0.6.1",
        "status": "affected"
      }
    ]
  }
]