Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
22 Jul 2022
21 Jul 2022
How to fix?
@openzeppelin/contracts to version 4.7.1 or higher.
@openzeppelin/contracts is a library for contract development.
Affected versions of this package are vulnerable to Information Exposure.
ERC165Checker.supportsInterface is designed to always successfully return a boolean, and under no circumstance revert. However, an incorrect assumption about Solidity 0.8's
abi.decode allows some cases to revert, given a target contract that doesn't implement EIP-165 as expected, specifically if it returns a value other than 0 or 1.
The contracts that may be affected are those that use
ERC165Checker to check for support for an interface and then handle the lack of support in a way other than reverting.