@openzeppelin/contracts@2.3.0 vulnerabilities

Secure Smart Contract library for Solidity

Direct Vulnerabilities

Known vulnerabilities in the @openzeppelin/contracts package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Improper Verification of Cryptographic Signature

@openzeppelin/contracts is a library for contract development.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via ECDSA.recover and ECDSA.tryRecover due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format.

How to fix Improper Verification of Cryptographic Signature?

Upgrade @openzeppelin/contracts to version 4.7.3 or higher.

<4.7.3
  • M
Denial of Service (DoS)

@openzeppelin/contracts is a library for contract development.

Affected versions of this package are vulnerable to Denial of Service (DoS) in the supportsERC165InterfaceUnchecked() function in ERC165Checker.sol and ERC165CheckerUpgradeable.sol, which can consume excessive resources when processing a large amount of data via an EIP-165 supportsInterface query.

How to fix Denial of Service (DoS)?

Upgrade @openzeppelin/contracts to version 4.7.2 or higher.

>=2.3.0 <4.7.2
  • C
Privilege Escalation

@openzeppelin/contracts is a library for contract development.

Affected versions of this package are vulnerable to Privilege Escalation. A vulnerability in TimelockController allowed an actor with the executor role to escalate privileges.

As a workaround, revoke the executor role from accounts not strictly under the team's control. It is recommended to revoke all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.

How to fix Privilege Escalation?

Upgrade @openzeppelin/contracts to version 4.3.1, 3.4.2 or higher.

>=4.0.0-beta.0 <4.3.1 <3.4.2
  • M
Improper Synchronization

@openzeppelin/contracts is a library for contract development.

Affected versions of this package are vulnerable to Improper Synchronization via the ERC777 contract. Extending this contract with a custom _beforeTokenTransfer function could allow a reentrancy attack to happen. When burning tokens, _beforeTokenTransfer is invoked before the send hook is externally called on the sender while token balances are adjusted afterwards. At the moment of the call to the sender, which can result in reentrancy, state managed by _beforeTokenTransfer may not correspond to the actual token balances or total supply.

How to fix Improper Synchronization?

Upgrade @openzeppelin/contracts to version 3.4.0-rc.0 or higher.

<3.4.0-rc.0