@0xabcdefg/smart-order-router (>=1.0.0, <=1.0.5), @0xabcdefg/universal-router-sdk (>=1.0.0, <=1.0.2) +838 more potentially affected by CVE-2022-35916 via @openzeppelin/contracts (>=4.6.0, <=4.7.1)

@openzeppelin/contracts NPM version =4.6.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =1.0.0, =0.2.0, =2.0.17, =0.0.1, =0.0.1, =0.0.1, =3.53.0, =3.59.0 and more Source cves: CVE-2022-35916 Source advisory: OSV:GHSA-9J3M-G383-29QR...

GHSA-9J3M-G383-29QR OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls

Impact Contracts using the cross chain utilies for Arbitrum L2, CrossChainEnabledArbitrumL2 or LibArbitrumL2, will classify direct interactions of externally owned accounts EOAs as cross chain calls, even though they are not started on L1. This is assessed as low severity because any action taken...

OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls

Impact Contracts using the cross chain utilies for Arbitrum L2, CrossChainEnabledArbitrumL2 or LibArbitrumL2, will classify direct interactions of externally owned accounts EOAs as cross chain calls, even though they are not started on L1. This is assessed as low severity because any action taken...

GHSA-7GRF-83VW-6F5X OpenZeppelin Contracts ERC165Checker unbounded gas consumption

Impact The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. Patches The issue has been fixed in v4.7.2. References...

@0xwen/core (>=0.0.1, <=0.0.3), @0xwen/core-v5 (>=0.0.1, <=0.0.3) +215 more potentially affected by CVE-2022-35915 via @openzeppelin/contracts-upgradeable (>=3.4.0, <=4.7.0)

@openzeppelin/contracts-upgradeable NPM version =3.4.0, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.2.1-alpha, =0.9.1, =0.19.0-beta.0, =2.0.0-alpha.1, =3.0.0-alpha0, =2.0.0-alpha.0, =3.0.1-alpha, =0.1.0-alpha, =0.24.2, =1.0.0-beta.1, =0.6.0-beta.0, =0.26.0 and more Source cves: CVE-2022-35915 Source...

0x-hunter-core (>=1.0.0-33, <=1.0.0-38), 1155-to-20 (>=1.0.0, <=1.0.2) +3110 more potentially affected by CVE-2022-35915 via @openzeppelin/contracts (>=2.3.0, <=4.7.1)

@openzeppelin/contracts NPM version =2.3.0, =1.0.0-33, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.9.1, =3.24.7, =1.7.2, =3.10.3, =0.0.2, =1.4.1, =1.0.0, =1.0.0-alpha.0, =1.1.0-alpha.0 and more Source cves: CVE-2022-35915 Source advisory: OSV:GHSA-7GRF-83VW-6F5X...

@acatalan/erc223-20-contracts (0.0.3), @adacash/liquidity-staker (0.0.1) +275 more potentially affected by CVE-2022-35915 via openzeppelin-solidity (>=2.0.0, <=3.4.2)

openzeppelin-solidity NPM version =2.0.0, =1.1.1, =0.3.0, =0.5.1, =0.3.2, =0.3.1, =0.3.1, =0.0.3, =0.1.0, =0.1.0, =2.2.1, =0.1.0, =0.1.4 and more Source cves: CVE-2022-35915 Source advisory: OSV:GHSA-7GRF-83VW-6F5X...

@centrifuge/ethereum-contracts (>=0.5.0, <=1.0.3-canary.4) potentially affected by CVE-2022-35915 via openzeppelin-eth (2.1.3)

openzeppelin-eth NPM version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on openzeppelin-eth and may be impacted: - @centrifuge/ethereum-contracts =0.5.0, =1.0.3-canary.4 Source cves: CVE-2022-35915 Source advisory: OSV:GHSA-7GRF-83VW-6F5X...

OpenZeppelin Contracts ERC165Checker unbounded gas consumption

Impact The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. Patches The issue has been fixed in v4.7.2. References...

CVE-2022-35961

OpenZeppelin Contracts is a library for secure smart contract development. The functions "ECDSA.recover" and "ECDSA.tryRecover" are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an...

CVE-2022-35961 ECDSA signature malleability in OpenZeppelin Contracts

OpenZeppelin Contracts is a library for secure smart contract development. The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issu...

CVE-2022-35961 ECDSA signature malleability in OpenZeppelin Contracts

OpenZeppelin Contracts is a library for secure smart contract development. The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issu...

CVE-2022-35961 ECDSA signature malleability in OpenZeppelin Contracts

OpenZeppelin Contracts is a library for secure smart contract development. The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issu...

CVE-2022-35961

OpenZeppelin Contracts (ECDSA.recover and ECDSA.tryRecover) suffer signature malleability due to acceptance of EIP-2098 compact signatures in the single-bytes variants (not when using r, v, s or r, vs). This could allow a reused/double-submitted signature to bypass replay protection in contracts ...

USE SAFETRANSFER()/SAFETRANSFERFROM() INSTEAD OF TRANSFER()/TRANSFERFROM()

Lines of code Vulnerability details Impact It is a good idea to add a require statement that checks the return value of ERC20 token transfers or to use something like OpenZeppelin’s safeTransfer/safeTransferFrom unless one is sure the given token reverts in case of a failure. Failure to do so wil...

CVE-2022-35961: Improper Validation of Integrity Check Value

OpenZeppelin Contracts is a library for secure smart contract development. The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issu...

Upgradeable contract is missing a __gap[50] storage variable to allow for new storage variables in later versions

Lines of code Vulnerability details Upgradeable contract is missing a gap50 storage variable to allow for new storage variables in later versions Impact For upgradeable contracts, there must be storage gap to "allow developers to freely add new state variables in the future without compromising t...

Lack of storage gap for upgradable contracts

Lines of code Vulnerability details Impact Safe usage of upgradable contract should include a storage gap to allow the addition of new state. OpenZeppelin docs Proof of Concept The following contracts on the project are using upgradable contracts from OpenZeppelin. File: contracts/Community.sol...

No storage gap for Upgradable contract might lead to storage slot collision

Lines of code Vulnerability details Impact For Upgradable contracts, there must be storage gap to “allow developers to freely add new state variables in the future without compromising the storage compatibility with existing deployments” quote OpenZeppelin. Otherwise it may be very difficult to...

No storage gap for Upgradable contract might lead to storage slot collision

Lines of code Vulnerability details Impact For upgradeable contracts, there must be storage gap to “allow developers to freely add new state variables in the future without compromising the storage compatibility with existing deployments” quote OpenZeppelin. Otherwise it may be very difficult to...