GitHub Advisoryadvisory · PyPI

GHSA-8mjr-jr5h-q2xr OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli

MEDIUM Published 2022-07-15 Modified 2024-11-22 Official page ↗
Aliases
CVE-2022-31153
Ecosystem
PyPI
Packages
openzeppelin-cairo-contracts
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-664, CWE-863
Reviewed
2022-07-15

Affected packages

• PyPI openzeppelin-cairo-contracts: < 0.2.1 → fixed in 0.2.1

Description

Impact This vulnerability affects all accounts (vanilla and ethereum flavors) in the v0.2.0 release of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet, so only goerli deployments of v0.2.0 accounts are affected. This faulty behavior is not observed in StarkNet's testing framework, so don't rely on it passing to detect this issue on custom accounts. Patches This bug has been patched in v0.2.1. References The issue is detailed in https://github.com/OpenZeppelin/cairo-contracts/issues/386. For more information If you have any questions or comments about this advisory: • Open an issue in the Contracts for Cairo repo • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2022-31153 OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. vulnerability

Weakness · CWE (2)

  • CWE-664 Improper Control of a Resource Through its Lifetime weakness
  • CWE-863 Incorrect Authorization weakness

References