Lucene search

K
githubGitHub Advisory DatabaseGHSA-MX2Q-35M2-X2RH
HistoryApr 17, 2023 - 4:45 p.m.

OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated

2023-04-1716:45:21
CWE-436
GitHub Advisory Database
github.com
11
openzeppelin
transparentupgradeableproxy
selector clashes
abi encoding
vulnerability

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

0.001 Low

EPSS

Percentile

39.4%

Impact

A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy’s own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding, the proxy could revert while attempting to decode the arguments from calldata.

The probability of an accidental clash is negligible, but one could be caused deliberately.

Patches

The issue has been fixed in v4.8.3.

Workarounds

If a function appears to be inaccessible for this reason, it may be possible to craft the calldata such that ABI decoding does not fail at the proxy and the function is properly proxied through.

References

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4154

Affected configurations

Vulners
Node
openzeppelincontracts_upgradeableRange3.2.0node.js
OR
openzeppelincontracts_upgradeableRange<4.8.3node.js
OR
openzeppelincontractsRange3.2.0node.js
OR
openzeppelincontractsRange<4.8.3node.js

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

0.001 Low

EPSS

Percentile

39.4%

Related for GHSA-MX2Q-35M2-X2RH