CVE-2022-31198 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts

OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a...

CVE-2022-31198 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts

OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a...

CVE-2022-31198

OpenZeppelin Contracts: GovernorVotesQuorumFraction vulnerability where lowering quorum could make past defeated proposals executable if votes meet the new quorum. Affected: GovernorVotesQuorumFraction-based governors in OpenZeppelin Contracts. Root cause: quorum is a percentage of total supply, ...

CVE-2022-31198

OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module "GovernorVotesQuorumFraction", a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a...

CVE-2022-31198 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts

OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a...

PT-2022-23022 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions prior to 4.7.2 Description: The issue affects contracts using the cross chain utilities for Arbitrum L2, specifically CrossChainEnabledArbitrumL2 or LibArbitrumL2. These contracts classify direct interactions o...

PT-2022-20606 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions prior to 4.7.2 Description: This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total...

PT-2022-23021 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions prior to 4.7.2 Description: The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a...

OpenZeppelin 安全漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin versions 4.3.0 through 4.7.2, and OpenZeppelin contracts-upgradeable versions 4.3.0 through 4.7.2, which stems from the fact that when a proposal is passed to...

OpenZeppelin 资源管理错误漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A resource management error vulnerability exists in versions prior to OpenZeppelin Contracts v4.7.2, which stems from the fact that this is a library for secure smart contract development, and the target contra...

CVE-2022-35915: Uncontrolled Resource Consumption

OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. The issue has been fixed in...

CVE-2022-35916: Incorrect Resource Transfer Between Spheres

OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, CrossChainEnabledArbitrumL2 or LibArbitrumL2, will classify direct interactions of externally owned accounts EOAs as cross chain calls, even though they are not...

CVE-2022-31198: Incorrect Calculation

OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a...

OpenZeppelin 安全漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin Contracts prior to version v4.7.2, which stems from the fact that this is a library for secure smart contract development, and that contracts using Arbitrum L2's...

Authentication Bypass

@openzeppelin/contractsvulnerable to improper input validation. The vulnerability exists in the ERC165Checker function in ERC165Checker.sol and ERC165CheckerUpgradeable function in ERC165CheckerUpgradeable.sol due to the incorrect assumption about abi.decode which allows a malicious user to pass ...

Authentication Bypass

@openzeppelin/contracts is vulnerable to authentication bypass. The vulnerability exists because the abi.decode is getting unexpectedly reverted in the isValidSignatureNow function of SignatureChecker.sol and supportsERC165Interfacedue function of ERC165Checker.soldue to the incorrect assumption...

CVE-2022-31170

OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning false. ERC165Checker.supportsInterface is designed to always successfully return a boolean, and under no circumstance revert. However, an...

CVE-2022-31172

OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. SignatureChecker.isValidSignatureNow is not expected to revert. However, an incorrect assumption about Solidity 0.8's abi.decode allows some cases to...

Authentication flaw

OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning false. ERC165Checker.supportsInterface is designed to always successfully return a boolean, and under no circumstance revert. However, an...

OpenZeppelin 输入验证错误漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. An input validation error vulnerability exists in OpenZeppelin Contracts versions 4.0.0 through 4.7.1, which stems from its susceptibility to being recovered by the ERC165 Checker instead of returning false...