GitHub Advisoryadvisory · npm

GHSA-4g63-c64m-25w9 OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers

HIGH Published 2022-07-21 Modified 2022-07-21 Official page ↗
Aliases
CVE-2022-31172
Ecosystem
npm
Packages
@openzeppelin/contracts, @openzeppelin/contracts-upgradeable
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20, CWE-347
Reviewed
2022-07-21

Affected packages

• npm @openzeppelin/contracts: >= 4.1.0, < 4.7.1 → fixed in 4.7.1 • npm @openzeppelin/contracts-upgradeable: >= 4.1.0, < 4.7.1 → fixed in 4.7.1

Description

Impact `SignatureChecker.isValidSignatureNow` is not expected to revert. However, an incorrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't implement EIP-1271 as expected. The contracts that may be affected are those that use `SignatureChecker` to check the validity of a signature and handle invalid signatures in a way other than reverting. We believe this to be unlikely. Patches The issue was patched in 4.7.1. References https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552 For more information If you have any questions or comments about this advisory, or need assistance deploying the fix, email us at [email protected].

Related

Alias · CVE (1)

  • CVE-2022-31172 OpenZeppelin Contracts is a library for smart contract development. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References