GitHub Advisoryadvisory · npm

GHSA-699g-q6qh-q4v8 OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4

MEDIUM Published 2023-12-12 Modified 2023-12-12 Official page ↗
Aliases
CVE-2023-49798
Ecosystem
npm
Packages
@openzeppelin/contracts, @openzeppelin/contracts-upgradeable
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-670
Reviewed
2023-12-12

Affected packages

• npm @openzeppelin/contracts: >= 4.9.4, < 4.9.5 → fixed in 4.9.5 • npm @openzeppelin/contracts-upgradeable: >= 4.9.4, < 4.9.5 → fixed in 4.9.5

Description

Context Merge conflict resolution issue when porting the v5.0.1 `Multicall` update to the v4.9 branch caused a duplicated line. Impact Versions using `Multicall` from `@openzeppelin/[email protected]` and `@openzeppelin/[email protected]` will execute each subcall twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers. Patches The duplicated `delegatecall` was removed in 4.9.5. The 4.9.4 version is marked as deprecated.

Related

Alias · CVE (1)

  • CVE-2023-49798 OpenZeppelin Contracts is a library for smart contract development. vulnerability

Weakness · CWE (1)

  • CWE-670 Always-Incorrect Control Flow Implementation weakness

References