GHSA-HQF9-8XV5-X8XW ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.

🗓️ 05 Jan 2026 19:57:46Reported by GoogleType

osv🔗 osv.dev👁 4 Views

ERC7984 wrapper may lose funds if mint fails silently after filling; upgrade to threepointone.

Reporter	Title	Published	Views	Family All 9
CVE	CVE-2026-73645	13 Aug 202617:54	–	cve
Cvelist	CVE-2026-73645 OpenZeppelin Confidential Contracts ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.	13 Aug 202617:54	–	cvelist
EUVD	EUVD-2026-58188	13 Aug 202617:54	–	euvd
Github Security Blog	ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.	5 Jan 202619:57	–	github
NVD	CVE-2026-73645	13 Aug 202618:18	–	nvd
Positive Technologies	PT-2026-71722	13 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-73645: Integer Overflow or Wraparound	13 Aug 202600:00	–	rapid7
vulnersOsv	@zentity/fhevm-contracts (>=0.1.0, <=0.2.0) potentially affected by CVE-2026-73645 via @openzeppelin/confidential-contracts (0.3.0)	5 Jan 202619:57	–	vulnersosv
Vulnrichment	CVE-2026-73645 OpenZeppelin Confidential Contracts ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.	13 Aug 202617:54	–	vulnrichment

Source	Link
github	www.github.com/OpenZeppelin/openzeppelin-confidential-contracts/security/advisories/GHSA-hqf9-8xv5-x8xw
github	www.github.com/OpenZeppelin/openzeppelin-confidential-contracts

13 Aug 2026 18:51Current

6.8Medium risk

Vulners AI Score6.8

CVSS 48.7

EPSS0.00384

confidential total supply mint may fail silent mint failure wrap risk upgrade threepointone