CVE-2024-27094

OpenZeppelin Contracts Base64.encode has a memory-read flaw when input length is not a multiple of 3, risking corruption of the encoded output. This affects OpenZeppelin Contracts (and upgradeable) prior to versions 5.0.2 and 4.9.6. Remediation: upgrade to 5.0.2 or 4.9.6. No exploit details are p...

CVE-2023-34459

OpenZeppelin Contracts (versions 4.7.0–4.9.1) are affected by a multiproof forgery issue when using verifyMultiProof/verifyMultiProofCalldata/processMultiProof/processMultiProofCalldata. If the merkle tree includes a node with value 0 at depth 1 under the root, a adversarial or certain benign tre...

CVE-2022-35961

OpenZeppelin Contracts (ECDSA.recover and ECDSA.tryRecover) suffer signature malleability due to acceptance of EIP-2098 compact signatures in the single-bytes variants (not when using r, v, s or r, vs). This could allow a reused/double-submitted signature to bypass replay protection in contracts ...

CVE-2022-35915

OpenZeppelin Contracts contains a vulnerability in the ERC165 supportsInterface logic where querying a target contract can cause unbounded gas consumption by returning a large amount of data. The issue is fixed in version 4.7.2; users are advised to upgrade. There are no public workarounds noted....

CVE-2022-35916

OpenZeppelin Contracts vulnerability CVE-2022-35916 affects cross-chain utilities for Arbitrum L2, specifically CrossChainEnabledArbitrumL2 and LibArbitrumL2. The issue classifies direct interactions of EOAs as cross-chain calls, even when not initiated on L1, due to how cross-chain interactions ...

CVE-2022-39384

OpenZeppelin Contracts (3.2.0–4.4.1) contain an initializer reentrancy issue caused by an exception used to support multiple inheritance, allowing reentry when an untrusted non-view external call is made during initialization. The impact is described as minor since upgradeable proxies are usually...

CVE-2023-30542

CVE-2023-30542 concerns OpenZeppelin Contracts’ GovernorCompatibilityBravo: the propose entrypoint may allow a signatures array shorter than the calldatas array, causing extra calldatas to be ignored and potentially executing actions without calldata if the proposal passes. The event reflects wha...

CVE-2022-31198

OpenZeppelin Contracts: GovernorVotesQuorumFraction vulnerability where lowering quorum could make past defeated proposals executable if votes meet the new quorum. Affected: GovernorVotesQuorumFraction-based governors in OpenZeppelin Contracts. Root cause: quorum is a percentage of total supply, ...

CVE-2023-26488

OpenZeppelin Contracts ERC721Consecutive has a balance-update bug for batches of size 1, causing balanceOf to overflow. Root cause: balances not updated after mint/batch transfers. Impact is partial (balance overflow risk) and fixes were applied in version 4.8.2; update to 4.8.2 or later to remed...

CVE-2023-49798

OpenZeppelin Contracts’ CVE-2023-49798 relates to a merge-conflict error in the Multicall.sol implementation that caused all subcalls to be executed twice in versions @openzeppelin/[email protected] and @openzeppelin/[email protected]. This duplication could lead to unintended duplicate o...

CVE-2023-30541

OpenZeppelin Contracts vulnerability CVE-2023-30541: The TransparentUpgradeableProxy can fail to delegate a function if its selector clashes with the proxy’s own selectors, causing a revert during calldata decoding when signatures are incompatible. The issue has been fixed in version 4.8.3. Impac...

CVE-2023-34234

OpenZeppelin Contracts’ Governor-related vulnerability (CVE-2023-34234) allows an attacker to frontrun the creation of a proposal, enabling the attacker to become the proposer and repeatedly cancel proposals. Affected: Governor (v4.9.0) and GovernorCompatibilityBravo (since v4.3.0). Root cause: l...