OpenZeppelin 数据伪造问题漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A data forgery issue vulnerability exists in OpenZeppelin Contracts versions 4.1.0 through 4.7.1, which stems from the possibility that the signature checker may recover on an invalid EIP-1271 signer...

GHSA-4G63-C64M-25W9 OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers

Impact SignatureChecker.isValidSignatureNow is not expected to revert. However, an incorrect assumption about Solidity 0.8's abi.decode allows some cases to revert, given a target contract that doesn't implement EIP-1271 as expected. The contracts that may be affected are those that use...

4337-snap (>=0.1.0, <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0, <=1.0.5) +1209 more potentially affected by CVE-2022-31172 via @openzeppelin/contracts (>=4.1.0, <=4.7.0)

@openzeppelin/contracts NPM version =4.1.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =1.0.0, =0.2.0, =1.0.2, =4.0.0-prerelease, =4.0.1-alpha, =2.0.0-beta.1, =2.0.3, =2.1.0 and more Source cves: CVE-2022-31172 Source advisory: OSV:GHSA-4G63-C64M-25W9...

@abacus-network/helloworld (>=0.2.1-alpha, <=0.2.1-beta2), @alt-research/orbit-sdk-avail (>=0.9.1, <=0.9.11) +108 more potentially affected by CVE-2022-31172 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.7.0)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =0.2.1-alpha, =0.9.1, =0.19.0-beta.0, =0.1.0-alpha, =0.24.2, =1.0.0-beta.1, =0.6.0-beta.0, =1.1.4-migration-beta.0, =1.0.0-beta.0, =1.0.0-upstream-0.19.0, =1.4.0, =1.5.0-beta.0 and more Source cves: CVE-2022-31172 Source advisory:...

OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers

Impact SignatureChecker.isValidSignatureNow is not expected to revert. However, an incorrect assumption about Solidity 0.8's abi.decode allows some cases to revert, given a target contract that doesn't implement EIP-1271 as expected. The contracts that may be affected are those that use...

GHSA-QH9X-GCFH-PCRW OpenZeppelin Contracts's ERC165Checker may revert instead of returning false

Impact ERC165Checker.supportsInterface is designed to always successfully return a boolean, and under no circumstance revert. However, an incorrect assumption about Solidity 0.8's abi.decode allows some cases to revert, given a target contract that doesn't implement EIP-165 as expected,...

@abacus-network/helloworld (>=0.2.1-alpha, <=0.2.1-beta2), @alt-research/orbit-sdk-avail (>=0.9.1, <=0.9.11) +108 more potentially affected by CVE-2022-31170 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.7.0)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =0.2.1-alpha, =0.9.1, =0.19.0-beta.0, =0.1.0-alpha, =0.24.2, =1.0.0-beta.1, =0.6.0-beta.0, =1.1.4-migration-beta.0, =1.0.0-beta.0, =1.0.0-upstream-0.19.0, =1.4.0, =1.5.0-beta.0 and more Source cves: CVE-2022-31170 Source advisory:...

4337-snap (>=0.1.0, <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0, <=1.0.5) +1211 more potentially affected by CVE-2022-31170 via @openzeppelin/contracts (>=4.0.0, <=4.7.0)

@openzeppelin/contracts NPM version =4.0.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =1.0.0, =0.2.0, =1.0.2, =4.0.0-prerelease, =4.0.1-alpha, =2.0.0-beta.1, =2.0.3, =2.1.0 and more Source cves: CVE-2022-31170 Source advisory: OSV:GHSA-QH9X-GCFH-PCRW...

OpenZeppelin Contracts's ERC165Checker may revert instead of returning false

Impact ERC165Checker.supportsInterface is designed to always successfully return a boolean, and under no circumstance revert. However, an incorrect assumption about Solidity 0.8's abi.decode allows some cases to revert, given a target contract that doesn't implement EIP-165 as expected,...

CVE-2022-31170 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false

OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning false. ERC165Checker.supportsInterface is designed to always successfully return a boolean, and under no circumstance revert. However, an...

CVE-2022-31170 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false

OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning false. ERC165Checker.supportsInterface is designed to always successfully return a boolean, and under no circumstance revert. However, an...

CVE-2022-31170

OpenZeppelin Contracts (library for smart contract development) contains a vulnerability in versions 4.0.0 through 4.7.1 where ERC165Checker.supportsInterface may revert instead of returning false due to an incorrect assumption about Solidity 0.8 abi.decode. This affects contracts that use ERC165...

CVE-2022-31170

OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning "false". "ERC165Checker.supportsInterface" is designed to always successfully return a boolean, and under no circumstance revert. However, ...

CVE-2022-31170 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false

OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning false. ERC165Checker.supportsInterface is designed to always successfully return a boolean, and under no circumstance revert. However, an...

CVE-2022-31172 OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers

OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. SignatureChecker.isValidSignatureNow is not expected to revert. However, an incorrect assumption about Solidity 0.8's abi.decode allows some cases to...

CVE-2022-31172 OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers

OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. SignatureChecker.isValidSignatureNow is not expected to revert. However, an incorrect assumption about Solidity 0.8's abi.decode allows some cases to...

CVE-2022-31172

OpenZeppelin Contracts (library) is affected by CVE-2022-31172 in versions 4.1.0–4.7.1, where SignatureChecker.isValidSignatureNow may revert due to an incorrect assumption about Solidity 0.8 ABI decoding, especially when a target contract does not implement EIP-1271 as expected. The vulnerabilit...

CVE-2022-31172

OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. "SignatureChecker.isValidSignatureNow" is not expected to revert. However, an incorrect assumption about Solidity 0.8's "abi.decode" allows some cases t...

CVE-2022-31172 OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers

OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. SignatureChecker.isValidSignatureNow is not expected to revert. However, an incorrect assumption about Solidity 0.8's abi.decode allows some cases to...

PT-2022-20584 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions 4.0.0 through 4.7.1 Description: The issue concerns the ERC165Checker in OpenZeppelin Contracts, which may revert instead of returning false under certain conditions. Specifically, this occurs when a target...