GHSA-5vp3-v4hc-gx76 UUPSUpgradeable vulnerability in @openzeppelin/contracts

• npm @openzeppelin/contracts: >= 4.1.0, < 4.3.2 → fixed in 4.3.2 • npm @openzeppelin/contracts-upgradeable: >= 4.1.0, < 4.3.2 → fixed in 4.3.2

Impact Upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon. Patches A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`. Workarounds Initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided in the forum. References Post-mortem. For more information If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at [email protected].