Always-Incorrect Control Flow Implementation Affecting @openzeppelin/contracts package, versions >=4.9.4 <4.9.5


0.0
medium

Snyk CVSS

    Attack Complexity High
    Integrity High

    Threat Intelligence

    EPSS 0.05% (17th percentile)
Expand this section
NVD
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-OPENZEPPELINCONTRACTS-6114711
  • published 10 Dec 2023
  • disclosed 9 Dec 2023
  • credit Unknown

How to fix?

Upgrade @openzeppelin/contracts to version 4.9.5 or higher.

Overview

@openzeppelin/contracts is a library for contract development.

Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to an issue with the Multicall.sol implementation. An attacker can cause unintended duplicate operations, such as asset transfers, by exploiting the fact that all subcalls are executed twice.

References