Integer Overflow or Wraparound Affecting @openzeppelin/confidential-contracts package, versions <0.3.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Integer Overflow or Wraparound vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-OPENZEPPELINCONFIDENTIALCONTRACTS-14874319
- published13 Jan 2026
- disclosed5 Jan 2026
- creditUnknown
Introduced: 5 Jan 2026
CVE NOT AVAILABLE CWE-190 (opens in a new tab)How to fix?
Upgrade @openzeppelin/confidential-contracts to version 0.3.1 or higher.
Overview
@openzeppelin/confidential-contracts is a Smart Contract library for use with confidential coprocessors
Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the wrap and onTransferReceived functions used by the ERC7984 contract. An attacker can cause users to lose funds by triggering a silent failure in the _mint function, resulting in the underlying tokens being sent without receiving the corresponding confidential wrapped tokens. By default, this overflow happens after wrapping ~18.4 trillion tokens.