GitHub Advisoryadvisory · npm
GHSA-878m-3g6q-594q OpenZeppelin Contracts contains Incorrect Calculation
MEDIUM
Official page ↗
- Aliases
- CVE-2023-26488
- Ecosystem
- npm
- Packages
- @openzeppelin/contracts, @openzeppelin/contracts-upgradeable
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-682
- Reviewed
- 2023-03-03
Affected packages
• npm @openzeppelin/contracts: >= 4.8.0, < 4.8.2 → fixed in 4.8.2
• npm @openzeppelin/contracts-upgradeable: >= 4.8.0, < 4.8.2 → fixed in 4.8.2
Description
Impact
The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the balance as reported by `balanceOf`.
The issue exclusively presents with batches of size 1.
Patches
The issue has been patched in 4.8.2.
Related
Alias · CVE (1)
- CVE-2023-26488 OpenZeppelin Contracts is a library for secure smart contract development. vulnerability
Weakness · CWE (1)
- CWE-682 Incorrect Calculation weakness
References
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-878m-3g6q-594q web
- https://nvd.nist.gov/vuln/detail/CVE-2023-26488 advisory
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/167bf67ed3907f4a674043496019fa346cee7705 web
- https://github.com/OpenZeppelin/openzeppelin-contracts package
- https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.8.2 web