WS-2021-0490

openzeppelin/contracts and openzeppelin/contracts-upgradeable are vulnerable to Initializer reentrancy that may lead to double initialization. Initializer functions that are invoked separate from contract creation the most prominent example being minimal proxies may be reentered if they make an...

@oasisprotocol/sapphire-contracts (0.2.17), @openwhaleorg/pendle (>=0.1.0, <=0.1.14) +15 more potentially affected by CVE-2025-54070 via @openzeppelin/contracts-upgradeable (>=5.2.0, <=5.3.0)

@openzeppelin/contracts-upgradeable NPM version =5.2.0, =0.1.0, =0.1.0, =0.0.4, =1.0.0, =0.1.0, =0.3.0, =0.5.3, =7.9.0-maine3c28f1, =3.0.0-rc.0, =1.0.0-alpha.1, =0.3.0, =0.3.0, =0.3.2, =0.1.0, =0.3.1 and more Source cves: CVE-2025-54070 Source advisory: OSV:GHSA-9RCW-C2F9-2J55...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +432 more potentially affected by CVE-2024-27094 via @openzeppelin/contracts-upgradeable (>=4.5.0, <=4.9.5)

@openzeppelin/contracts-upgradeable NPM version =4.5.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =0.2.1-alpha, =0.2.1-beta2 and more Source cves: CVE-2024-27094 Source advisory:...

@etherisc/gif-next (>=0.0.2-00080dc-272, <=0.0.2-ff8087d-237), @ethsign/sign-protocol-evm (>=1.0.0, <=1.1.3) +9 more potentially affected by CVE-2024-27094 via @openzeppelin/contracts-upgradeable (>=5.0.0, <=5.0.1)

@openzeppelin/contracts-upgradeable NPM version =5.0.0, =0.0.2-00080dc-272, =1.0.0, =2.5.5, =1.0.0, =1.0.0-beta-rc1, =0.0.1, =1.0.1, =0.1.0-alpha.8, =0.1.0 Source cves: CVE-2024-27094 Source advisory: OSV:GHSA-9VX6-7XXF-X967...

PT-2023-31356

Name of the Vulnerable Software and Affected Versions @openzeppelin/contracts versions 4.9.4 @openzeppelin/contracts-upgradeable versions 4.9.4 Description A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication in the Multicall.sol file. This results in all subcall...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +410 more potentially affected by CVE-2023-40014 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.9.2)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =0.2.1-alpha, =0.2.1-beta2 and more Source cves: CVE-2023-40014 Source advisory:...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +336 more potentially affected by CVE-2023-34459 via @openzeppelin/contracts-upgradeable (>=4.7.0, <=4.8.3)

@openzeppelin/contracts-upgradeable NPM version =4.7.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =3.1.0 - @abheektripathy/nftpass 1.1.0 and more Source cves: CVE-2023-34459 Source...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +361 more potentially affected by CVE-2023-30542 via @openzeppelin/contracts-upgradeable (>=4.3.0, <=4.8.2)

@openzeppelin/contracts-upgradeable NPM version =4.3.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =0.2.1-alpha, =0.2.1-beta2 and more Source cves: CVE-2023-30542 Source advisory:...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +468 more potentially affected by CVE-2023-30541 via @openzeppelin/contracts-upgradeable (>=3.4.0, <=4.8.2)

@openzeppelin/contracts-upgradeable NPM version =3.4.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =0.0.1, =0.0.1, =4.0.0-prerelease-17, =4.3.4 and more Source cves: CVE-2023-30541 Source advisory: OSV:GHSA-MX2Q-35M2-X2RH...

Upgradable liberty

Lines of code Vulnerability details Impact Instead of using @openzeppelin/contracts, use the upgradable liberty for contracts that should be able to be upgraded. This is the library that should be used :@openzeppelin/contracts-upgradeable Proof of Concept For more info have a look at this resourc...

Upgradeable

Lines of code Vulnerability details Impact Since the contract OndoPriceOracle.sol is a critical contract it should have room to be upgrade, either use the library @openzeppelin/contracts-upgradeable or leave a storage gap. An example of this would be to add this line: uint25650 private gap; Proof...

@abacus-network/helloworld (>=0.2.1-alpha, <=0.2.1-beta2), @alt-research/orbit-sdk-avail (>=0.9.1, <=0.9.11) +108 more potentially affected by CVE-2022-35961 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.7.0)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =0.2.1-alpha, =0.9.1, =0.19.0-beta.0, =0.1.0-alpha, =0.24.2, =1.0.0-beta.1, =0.6.0-beta.0, =1.1.4-migration-beta.0, =1.0.0-beta.0, =1.0.0-upstream-0.19.0, =1.4.0, =1.5.0-beta.0 and more Source cves: CVE-2022-35961 Source advisory:...

@abacus-network/helloworld (>=0.2.1-alpha, <=0.2.1-beta2), @alt-research/orbit-sdk-avail (>=0.9.1, <=0.9.11) +106 more potentially affected by CVE-2022-31198 via @openzeppelin/contracts-upgradeable (>=4.3.0, <=4.7.0)

@openzeppelin/contracts-upgradeable NPM version =4.3.0, =0.2.1-alpha, =0.9.1, =0.19.0-beta.0, =0.1.0-alpha, =0.24.2, =1.0.0-beta.1, =0.6.0-beta.0, =1.1.4-migration-beta.0, =1.0.0-beta.0, =1.0.0-upstream-0.19.0, =1.4.0, =1.5.0-beta.0 and more Source cves: CVE-2022-31198 Source advisory:...

@0xwen/core (>=0.0.1, <=0.0.3), @0xwen/core-v5 (>=0.0.1, <=0.0.3) +215 more potentially affected by CVE-2022-35915 via @openzeppelin/contracts-upgradeable (>=3.4.0, <=4.7.0)

@openzeppelin/contracts-upgradeable NPM version =3.4.0, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.2.1-alpha, =0.9.1, =0.19.0-beta.0, =2.0.0-alpha.1, =3.0.0-alpha0, =2.0.0-alpha.0, =3.0.1-alpha, =0.1.0-alpha, =0.24.2, =1.0.0-beta.1, =0.6.0-beta.0, =0.26.0 and more Source cves: CVE-2022-35915 Source...

@abacus-network/helloworld (>=0.2.1-alpha, <=0.2.1-beta2), @alt-research/orbit-sdk-avail (>=0.9.1, <=0.9.11) +108 more potentially affected by CVE-2022-31172 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.7.0)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =0.2.1-alpha, =0.9.1, =0.19.0-beta.0, =0.1.0-alpha, =0.24.2, =1.0.0-beta.1, =0.6.0-beta.0, =1.1.4-migration-beta.0, =1.0.0-beta.0, =1.0.0-upstream-0.19.0, =1.4.0, =1.5.0-beta.0 and more Source cves: CVE-2022-31172 Source advisory:...

@abacus-network/helloworld (>=0.2.1-alpha, <=0.2.1-beta2), @alt-research/orbit-sdk-avail (>=0.9.1, <=0.9.11) +108 more potentially affected by CVE-2022-31170 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.7.0)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =0.2.1-alpha, =0.9.1, =0.19.0-beta.0, =0.1.0-alpha, =0.24.2, =1.0.0-beta.1, =0.6.0-beta.0, =1.1.4-migration-beta.0, =1.0.0-beta.0, =1.0.0-upstream-0.19.0, =1.4.0, =1.5.0-beta.0 and more Source cves: CVE-2022-31170 Source advisory:...

[WP-H0] Wrong implementation of EIP712MetaTransaction

Lines of code Vulnerability details 1. EIP712MetaTransaction is a utils contract that intended to be inherited by concrete actual contracts, therefore. it's initializer function should not use the initializer modifier, instead, it should use onlyInitializing modifier. See the implementation of...

@hifi/amm (>=1.1.2, <=1.4.0), @hifi/flash-swap (>=1.0.1, <=1.3.1) +6 more potentially affected by unknown CVE via @openzeppelin/contracts-upgradeable (4.2.0)

@openzeppelin/contracts-upgradeable NPM version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/contracts-upgradeable and may be impacted: - @hifi/amm =1.1.2, =1.0.1, =1.1.2, =1.0.0, =0.8.1-pr-brioux-1333.92b26c3a.36, =1.0.5, =2.3.0...

PT-2022-28259

Name of the Vulnerable Software and Affected Versions @openzeppelin/contracts versions prior to v4.4.2 @openzeppelin/contracts-upgradeable versions prior to v4.4.2 Description The issue arises from the GovernorCompatibilityBravo module, which may lead to the creation of governance proposals that...

@0xwen/core (>=0.0.1, <=0.0.3), @0xwen/core-v5 (>=0.0.1, <=0.0.3) +128 more potentially affected by CVE-2021-46320 +1 more via @openzeppelin/contracts-upgradeable (>=3.4.0, <=4.3.3)

@openzeppelin/contracts-upgradeable NPM version =3.4.0, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =2.0.0-alpha.1, =3.0.0-alpha0, =2.0.0-alpha.0, =3.0.1-alpha, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0, =1.0.4 and more Source cves: CVE-2021-46320, CVE-2022-39384 Source advisory: OSV:GHSA-9C22-PWXW-P6HX...