GitHub Advisoryadvisory · npm

GHSA-88g8-f5mf-f5rj Improper Initialization in OpenZeppelin

HIGH Published 2022-02-05 Modified 2022-02-11 Official page ↗
Aliases
CVE-2021-46320
Ecosystem
npm
Packages
@openzeppelin/contracts
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-665
Reviewed
2022-02-11

Affected packages

• npm @openzeppelin/contracts: < 4.4.1 → fixed in 4.4.1

Description

In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible, breaking the expectation that there is a single execution.

Related

Alias · CVE (1)

  • CVE-2021-46320 In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal… vulnerability

Weakness · CWE (1)

  • CWE-665 Improper Initialization weakness

References