oz-known-issues

OpenZeppelin Known Vulnerabilities Find the version that the project you currently develop or audit uses and quickly check which are the known smart contract security vulnerabilities that may affect your code. Source: https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories...

EUVD-2023-2289

Malicious code in bioql PyPI...

Improper Encoding

openzeppelin/contracts is vulnerable to Improper Encoding. The vulnerability exists due to improperly validating ERC2771Context which allows an attacker to cause unintended behavior in smart contracts that rely on the sender's accurate identification...

OpenZeppelin Contracts vulnerable to Improper Escaping of Output

Impact OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address0 in calls that originate from the forwarder with calldata...

GHSA-G4VP-M682-QQMP OpenZeppelin Contracts vulnerable to Improper Escaping of Output

Impact OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address0 in calls that originate from the forwarder with calldata...

CVE-2023-40014

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address0 in calls that originate from the forwarder with calldata shorter...

CVE-2023-40014

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address0 in calls that originate from the forwarder with calldata shorter...

CVE-2023-40014 OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address0 in calls that originate from the forwarder with calldata shorter...

CVE-2023-40014 OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address0 in calls that originate from the forwarder with calldata shorter...

CVE-2023-40014 OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address0 in calls that originate from the forwarder with calldata shorter...

CVE-2023-40014

OpenZeppelin Contracts (v4.0.0–v4.9.3) is vulnerable to an issue in ERC2771Context used with a custom trusted forwarder, where _msgSender may evaluate to address(0) for calls from the forwarder with calldata shorter than 20 bytes. The problem is not common for MinimalForwarder, as signer addresse...

CVE-2023-40014

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using "ERC2771Context" along with a custom trusted forwarder may see "msgSender" return "address0" in calls that originate from the forwarder with calldata...

PT-2023-27209 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions 4.0.0 through 4.9.3 Description: OpenZeppelin Contracts is a library for secure smart contract development. Contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address0...

CVE-2023-40014: Improper Encoding or Escaping of Output

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address0 in calls that originate from the forwarder with calldata shorter...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +372 more potentially affected by CVE-2023-34234 via @openzeppelin/contracts-upgradeable (>=4.3.0, <=4.8.3)

@openzeppelin/contracts-upgradeable NPM version =4.3.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =0.2.1-alpha, =0.2.1-beta2 and more Source cves: CVE-2023-34234 Source advisory:...

@aragon/core-contracts (>=0.3.0-alpha, <=3.0.0-alpha), @benddao/bend-downpayment (1.0.0) +21 more potentially affected by CVE-2022-35916 via @openzeppelin/contracts-upgradeable (>=4.6.0, <=4.7.0)

@openzeppelin/contracts-upgradeable NPM version =4.6.0, =0.3.0-alpha, =1.2.0, =0.0.2, =0.1.0-rc-1, =0.1.6, =0.1.0, =0.2.0 and more Source cves: CVE-2022-35916 Source advisory: OSV:GHSA-9J3M-G383-29QR...

@avalabs/avalanche-wallet-sdk (>=0.3.0, <=0.9.4), @b0dhidharma/contract-utils (0.1.1) +62 more potentially affected by CVE-2021-41264 via @openzeppelin/contracts (>=4.1.0, <=4.3.1)

@openzeppelin/contracts NPM version =4.1.0, =0.3.0, =0.0.2, =1.0.0, =1.1.0, =2.0.0-alpha.0, =0.1.1, =0.0.1, =3.0.0-alpha.2, =3.0.0-alpha.1, =3.0.0-alpha.1, =3.0.0-alpha.1, =0.0.0-736762ba, =0.0.23-canary and more Source cves: CVE-2021-41264 Source advisory: OSV:GHSA-5VP3-V4HC-GX76...