[WP-H0] Wrong implementation of EIP712MetaTransaction

Lines of code Vulnerability details 1. EIP712MetaTransaction is a utils contract that intended to be inherited by concrete actual contracts, therefore. it's initializer function should not use the initializer modifier, instead, it should use onlyInitializing modifier. See the implementation of...

@hifi/amm (>=1.1.2, <=1.4.0), @hifi/flash-swap (>=1.0.1, <=1.3.1) +6 more potentially affected by unknown CVE via @openzeppelin/contracts-upgradeable (4.2.0)

@openzeppelin/contracts-upgradeable NPM version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/contracts-upgradeable and may be impacted: - @hifi/amm =1.1.2, =1.0.1, =1.1.2, =1.0.0, =0.8.1-pr-brioux-1333.92b26c3a.36, =1.0.5, =2.3.0...

Privilege Escalation

openzeppelin/contracts is vulnerable to privilege escalation. The vulnerability exists due to the lack of sanitization in the initializer function which allowed an actor with executor role to escalate privileges...

4337-snap (>=0.1.0, <=0.1.1), @1inch/limit-order-protocol-contract (>=4.0.0-prerelease, <=4.3.4) +240 more potentially affected by CVE-2021-46320 +1 more via @openzeppelin/contracts (>=4.0.0, <=4.4.0)

@openzeppelin/contracts NPM version =4.0.0, =0.1.0, =4.0.0-prerelease, =4.0.1-alpha, =2.0.0-beta.1, =0.1.0, =0.3.0, =0.0.2, =0.0.1, =0.0.1, =1.0.0, =0.0.28, =0.4.1, =0.7.5 - @biconomy-devx/paymasters 1.0.0 and more Source cves: CVE-2021-46320, CVE-2022-39384 Source advisory: OSV:GHSA-88G8-F5MF-F5...

Safe transfers are vulnerable to EOA calls

Handle 0x1f8b Vulnerability details Impact Safe erc20 calls are prone to EOA calls and human errors. Proof of Concept Recently there was one of the biggest hacks in crypto, 80m$ was lost. One of the root causes of the vulnerability was the fact that tokenAddress.safeTransferFrom does not revert...

4337-snap (>=0.1.0, <=0.1.1), @1inch/limit-order-protocol-contract (>=4.0.0-prerelease, <=4.3.4) +223 more potentially affected by unknown CVE via @openzeppelin/contracts (>=4.3.0, <=4.4.1)

@openzeppelin/contracts NPM version =4.3.0, =0.1.0, =4.0.0-prerelease, =4.0.1-alpha, =2.0.0-beta.1, =0.1.0, =0.9.5, =1.0.0, =2.0.9, =0.0.1, =0.0.1, =1.0.0, =0.0.28, =0.4.1, =0.7.5 - @biconomy-devx/paymasters 1.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-M6W8-FQ7V-PH4M...

PT-2022-28259

Name of the Vulnerable Software and Affected Versions @openzeppelin/contracts versions prior to v4.4.2 @openzeppelin/contracts-upgradeable versions prior to v4.4.2 Description The issue arises from the GovernorCompatibilityBravo module, which may lead to the creation of governance proposals that...

0x-hunter-core (>=1.0.0-33, <=1.0.0-38), 1155-to-20 (>=1.0.0, <=1.0.2) +2758 more potentially affected by CVE-2021-46320 +1 more via @openzeppelin/contracts (>=3.2.0, <=4.4.0)

@openzeppelin/contracts NPM version =3.2.0, =1.0.0-33, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.9.1, =3.24.7, =1.7.2, =3.10.3, =0.0.2, =1.4.1, =1.0.0, =1.0.0-alpha.0, =1.1.0-alpha.0 and more Source cves: CVE-2021-46320, CVE-2022-39384 Source advisory: OSV:GHSA-9C22-PWXW-P6HX...

Usage of an incorrect version of ERC20Permit contract can give unknown token with 0 decimals after upgrade.

Handle Jujic Vulnerability details Impact Based on the context and comments in the code, the Malt.sol contract is designed to be deployed as an upgradeable proxy contract. In Solidity, code that is inside a constructor or part of a global variable declaration is not part of a deployed contract’s...

ERC1155Supply vulnerability in OpenZeppelin Contracts

Handle defsec Vulnerability details Impact When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the ERC1155Supply extension, total supply is not updated until after the callback, thus during the callback the reported total...

@avalabs/avalanche-wallet-sdk (>=0.9.5, <=0.10.2), @b0dhidharma/contract-utils (0.1.1) +66 more potentially affected by unknown CVE via @openzeppelin/contracts (>=4.2.0, <=4.3.2)

@openzeppelin/contracts NPM version =4.2.0, =0.9.5, =0.0.2, =0.0.1, =0.0.1, =1.0.0, =0.0.1, =1.1.0, =0.0.1, =3.0.0-alpha.2, =3.0.0-alpha.1, =3.0.0-alpha.1, =3.0.0-alpha.1, =3.0.0-alpha.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WMPV-C2JP-J2XG...

Privilege Escalation

openzeppelin-contracts is vulnerable to privilege escalation. Remote attackers are able to exploit vulnerable upgradeTo and upgradeToAndCall functions in UUPSUpgradeable component due to uninitialized implementation contracts...

PT-2021-24469

Name of the Vulnerable Software and Affected Versions: @openzeppelin/contracts versions prior to 4.3.3 @openzeppelin/contracts-upgradeable versions prior to 4.3.3 Description: The issue arises when ERC1155 tokens are minted and a callback is invoked on the receiver, as required by the spec. When...

CVE-2021-41264

OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of @openzeppelin/contracts and...

CVE-2021-41264

OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of @openzeppelin/contracts and...

CVE-2021-41264

OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of @openzeppelin/contracts and...

Design/Logic Flaw

OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of @openzeppelin/contracts and...

CVE-2021-41264

OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using "UUPSUpgradeable" may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of "@openzeppelin/contracts" and...

CVE-2021-41264 UUPSUpgradeable vulnerability in OpenZeppelin Contracts

OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of @openzeppelin/contracts and...

CVE-2021-41264

OpenZeppelin CVE-2021-41264 affects upgradeable contracts using UUPSUpgradeable due to uninitialized implementation contracts. The vulnerability is addressed in version 4.3.2 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. If upgrading is not possible, a mitigation is to initi...