OpenZeppelin Contracts contains Incorrect Calculation

2023-03-0320:02:16

CWE-682

GitHub Advisory Database

github.com

openzeppelin contracts

incorrect calculation

nfts

batches

update balances

transfers

erc721consecutive

patches

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

29.7%

JSON

Impact

The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the balance as reported by balanceOf.

The issue exclusively presents with batches of size 1.

Patches

The issue has been patched in 4.8.2.

Affected configurations

Vulners

Node

openzeppelincontracts_upgradeableRange4.8.0–4.8.2node.js

openzeppelinopenzeppelin_contractsRange4.8.0–4.8.2

VendorProductVersionCPE
openzeppelincontracts_upgradeable*cpe:2.3:a:openzeppelin:contracts_upgradeable:*:*:*:*:*:node.js:*:*
openzeppelinopenzeppelin_contracts*cpe:2.3:a:openzeppelin:openzeppelin_contracts:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openzeppelin	contracts_upgradeable	*	cpe:2.3:a:openzeppelin:contracts_upgradeable::::::node.js::*
openzeppelin	openzeppelin_contracts	*	cpe:2.3:a:openzeppelin:openzeppelin_contracts::::::::