Openzeppelin contracts with critical and high vulnerabilities can be installed and used

Lines of code Vulnerability details Impact Currently, @openzeppelin/contracts and @openzeppelin/contracts-upgradeable versions are set as follows. "@openzeppelin/contracts": "^4.1.0", "@openzeppelin/contracts-upgradeable": "^4.1.0", For the specified version, there are some critical and high...

Voting signature malleability of EVM's ecrecover in castVoteBySig

Lines of code Vulnerability details Proof of Concept EVM's ecrecover is susceptible to signature malleability which allows replay attacks, but that is mitigated here by doing receipt.hasVoted = true;. However, if any of the application logic changes, it might make signature malleability a risk fo...

Storage collision between proxy and logic v2

Lines of code Vulnerability details The lack of using EIP1967 proposal can lead to a storage collision on variables when implementing proxy-implementation pattern. More details can be found here; Impact Since the project implementing proxies with logic and implementation pattern where they share...

Update initializer modifier to prevent reentrancy during initialization

Lines of code Vulnerability details package.json L32-33 The solution uses: "@openzeppelin/contracts": "^4.1.0", "@openzeppelin/contracts-upgradeable": "^4.1.0", The current implementation of initialize function in both NounsDAOLogicV1.sol and NounsDAOLogicV2.sol are not using initializer modifier...

The repository uses versions of OpenZeppelin libraries with critical severity vulnerabilities

Lines of code Vulnerability details Proof of Concept The project uses 4.1.0 for both @openzeppelin/contracts and @openzeppelin/contracts-upgradeable but OpenZeppelin has flagged them as versions with critical severity vulnerability: GHSA-5vp3-v4hc-gx76 Also in those versions you have this...

@abacus-network/helloworld (>=0.2.1-alpha <=0.2.1-beta2), @alt-research/orbit-sdk-avail (>=0.9.1 <=0.9.11) +108 more potentially affected by CVE-2022-35961 via @openzeppelin/contracts-upgradeable (>=4.2.0 <=4.7.0)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =0.2.1-alpha, =0.9.1, =0.19.0-beta.0, =0.1.0-alpha, =0.24.2, =1.0.0, =0.6.0, =1.1.4-migration-beta.0, =1.0.0-beta.0, =1.0.0-upstream-0.19.0, =1.4.0, =1.5.0-beta.0 and more Source cves: CVE-2022-35961 Source advisory: OSV:GHSA-4H98-2769-GH6H...

OpenZeppelin Contracts vulnerable to ECDSA signature malleability

Impact The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issue for the functions that take a single bytes argument, and not the...

GHSA-4H98-2769-GH6H OpenZeppelin Contracts vulnerable to ECDSA signature malleability

Impact The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issue for the functions that take a single bytes argument, and not the...

@abacus-network/helloworld (>=0.2.1-alpha <=0.2.1-beta2), @alt-research/orbit-sdk-avail (>=0.9.1 <=0.9.11) +106 more potentially affected by CVE-2022-31198 via @openzeppelin/contracts-upgradeable (>=4.3.0 <=4.7.0)

@openzeppelin/contracts-upgradeable NPM version =4.3.0, =0.2.1-alpha, =0.9.1, =0.19.0-beta.0, =0.1.0-alpha, =0.24.2, =1.0.0, =0.6.0, =1.1.4-migration-beta.0, =1.0.0-beta.0, =1.0.0-upstream-0.19.0, =1.4.0, =1.5.0-beta.0 and more Source cves: CVE-2022-31198 Source advisory: OSV:GHSA-XRC4-737V-9Q75...

4337-snap (>=0.1.0 <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0 <=1.0.5) +1248 more potentially affected by CVE-2022-31198 via @openzeppelin/contracts (>=4.3.0 <=4.7.1)

@openzeppelin/contracts NPM version =4.3.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =1.0.0, =0.2.0, =4.14.3, =1.0.2, =4.0.0, =4.0.1, =2.0.0, =3.1.0 and more Source cves: CVE-2022-31198 Source advisory: OSV:GHSA-XRC4-737V-9Q75...

OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals

Impact This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a proposal is passed to lower the quorum requirement, past proposals ma...

GHSA-XRC4-737V-9Q75 OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals

Impact This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a proposal is passed to lower the quorum requirement, past proposals ma...

Not calling approve(0) before setting a new approval might cause reverts when used with Tether (USDT)

Lines of code Vulnerability details Impact Some tokens do not implement the ERC20 standard properly but are still accepted by most code that accepts ERC20 tokens. For example Tether USDT's approve function will revert if the current approval is not zero, to protect against front-running changes o...

Authorization Bypass

OpenZeppelin contracts are vulnerable to authorization bypass. The vulnerability is due to functions ECDSA.recover and ECDSA.tryRecover accepting EIP-2098 and 65-byte signatures. Affected contracts have signature reuse or replay protection, implemented by marking the signature as used rather than...

CVE-2022-35961

OpenZeppelin Contracts is a library for secure smart contract development. The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issu...

Format string

OpenZeppelin Contracts is a library for secure smart contract development. The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issu...

_safeMint() should be used rather than _mint() wherever possible

Lines of code Vulnerability details safeMint should be used rather than mint wherever possible Impact In NFTCollections.sol and NFTDropCollection, eventually it is called ERC721 mint. Calling mint this way does not ensure that the receiver of the NFT is able to accept them, making possible to los...

createLock: User can lose funds by sending a wrong _value parameter

Lines of code Vulnerability details Impact Users can lose funds by sending a wrong value parameter. The problems relays in casting value to int128. Solidity does not check casting, just math operations. If a user tries to lock an amount greater than 2^128, the transaction won't be reverted and...

[H1] Protocol is unusable with some ERC20 tokens

Lines of code Vulnerability details Impact ​ Protocol unusable for USDT and other bad tokens Proof of Concept ​ Some ERC20 tokens do not implement correctly EIP-20 standard. They just do not return a boolean in transfer/transferFrom functions and just return void. Asking them for a boolean will...

FETH.sol is susceptible to ERC20 approve functionality front-running exploit

Lines of code Vulnerability details Proof of concept The problem is perfectly described here The tldr; is that if you approved a person to spend 100 tokens and then you want to decrease his allowance to 50, if he spends his 100 tokens allowance before you set his allowance to 50 he will be able t...