Always-Incorrect Control Flow Implementation Affecting @openzeppelin/contracts package, versions >=4.9.4 <4.9.5
Threat Intelligence
EPSS
0.05% (19th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-OPENZEPPELINCONTRACTS-6114711
- published 10 Dec 2023
- disclosed 9 Dec 2023
- credit Unknown
Introduced: 9 Dec 2023
CVE-2023-49798 Open this link in a new tabHow to fix?
Upgrade @openzeppelin/contracts to version 4.9.5 or higher.
Overview
@openzeppelin/contracts is a library for contract development.
Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to an issue with the Multicall.sol implementation. An attacker can cause unintended duplicate operations, such as asset transfers, by exploiting the fact that all subcalls are executed twice.
References
CVSS Scores
version 3.1