PT-2023-24891

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts versions 4.7.0 through 4.9.2 Description The issue allows constructing merkle trees that enable forging a valid multiproof for an arbitrary set of leaves when the verifyMultiProof, verifyMultiProofCalldata,...

CVE-2023-34459: Improper Validation of Integrity Check Value

OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to version 4.9.2, when the verifyMultiProof, verifyMultiProofCalldata, procesprocessMultiProof, or processMultiProofCalldat functions are in use, it is possible to construct merkle trees that...