Malicious Package

Overview @openzeppelin-compact/fungible-token is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Linux Distros Unpatched Vulnerability : CVE-2023-40014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context...

@1inch/delegating (=2.0.0), @1inch/farming (=4.0.0) +31 more potentially affected by CVE-2025-54070 via @openzeppelin/contracts (>=5.2.0 <=5.3.0)

@openzeppelin/contracts NPM version =5.2.0, =1.0.0-alpha.9, =0.0.4, =1.0.0, =0.1.0, =0.4.27, =0.3.0, =0.5.3, =7.9.0-main3c5a2f8, =7.9.0-maine3c28f1, =7.9.0-main01f77d70, =7.9.0-mainc91b9b3, =7.9.0-main163e291, =7.9.0-main0cdac11, =8.0.9-prffd008c and more Source cves: CVE-2025-54070 Source...

4337-snap (>=0.1.0 <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0 <=1.0.5) +1546 more potentially affected by CVE-2023-40014 via @openzeppelin/contracts (>=4.0.0 <=4.9.2)

@openzeppelin/contracts NPM version =4.0.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.123.2 and more Source cves: CVE-2023-40014 Source advisory: OSV:GHSA-G4VP-M682-QQMP...

4337-snap (>=0.1.0 <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0 <=1.0.5) +1441 more potentially affected by CVE-2023-30542 via @openzeppelin/contracts (>=4.3.0 <=4.8.2)

@openzeppelin/contracts NPM version =4.3.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.123.2 and more Source cves: CVE-2023-30542 Source advisory: OSV:GHSA-93HQ-5WGC-JC82...

4337-snap (>=0.1.0 <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0 <=1.0.5) +1275 more potentially affected by CVE-2022-35961 via @openzeppelin/contracts (>=4.1.0 <=4.7.2)

@openzeppelin/contracts NPM version =4.1.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =1.0.0, =0.2.0, =4.14.3, =1.0.2, =4.0.0, =4.0.1, =2.0.0, =3.1.0 and more Source cves: CVE-2022-35961 Source advisory: OSV:GHSA-4H98-2769-GH6H...

@0xabcdefg/smart-order-router (>=1.0.0 <=1.0.5), @0xabcdefg/universal-router-sdk (>=1.0.0 <=1.0.2) +903 more potentially affected by CVE-2022-35916 via @openzeppelin/contracts (>=4.6.0 <=4.7.1)

@openzeppelin/contracts NPM version =4.6.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =1.0.0, =0.2.0, =4.14.3, =2.0.17, =0.0.1, =0.0.1, =0.0.1, =0.0.17 and more Source cves: CVE-2022-35916 Source advisory: OSV:GHSA-9J3M-G383-29QR...

@aragon/core-contracts (>=0.3.0-alpha <=3.0.0-alpha), @benddao/bend-downpayment (=1.0.0) +21 more potentially affected by CVE-2022-35916 via @openzeppelin/contracts-upgradeable (>=4.6.0 <=4.7.0)

@openzeppelin/contracts-upgradeable NPM version =4.6.0, =0.3.0-alpha, =1.2.0, =0.0.2, =0.1.0, =0.1.6, =0.1.0, =0.2.0 and more Source cves: CVE-2022-35916 Source advisory: OSV:GHSA-9J3M-G383-29QR...

0x-hunter-core (>=1.0.0-33 <=1.0.0-38), 1155-to-20 (>=1.0.0 <=1.0.2) +2830 more potentially affected by CVE-2021-46320 via @openzeppelin/contracts (>=2.3.0 <=4.4.0)

@openzeppelin/contracts NPM version =2.3.0, =1.0.0-33, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.9.1, =3.24.7, =1.7.2, =3.10.3, =0.0.2, =1.4.1, =1.0.0, =1.12.0 - @0xkkkkkkkkkkkkkkk/dodo =2.0.1 and more Source cves: CVE-2021-46320 Source advisory: OSV:GHSA-88G8-F5MF-F5RJ...

No use of reentrency guards

Handle jayjonah8 Vulnerability details Impact The README.md makes the point that reentrancy attacks are a cause for concern, but the protocol makes no use of reentrancy guards in any file or in the functions users interact with. Proof of Concept The are no Reentrancy guards in the entire code bas...

Multicall.sol batch calls don't update msg.value

Handle jayjonah8 Vulnerability details Impact In NestedFactory.sol using Multicall.sol can be dangerous when it has a msg.value inside a loop since the msg.value doesn't update every iteration. This can lead to a user sending ETH one time and it being counted for every iteration. There is a...

GHSA-VRW4-W73R-6MM8 TimelockController vulnerability in OpenZeppelin Contracts

Impact A vulnerability in TimelockController allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to "open"...

CVE-2021-39167

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...