Always-Incorrect Control Flow Implementation Affecting @openzeppelin/contracts-upgradeable package, versions >=4.9.4 <4.9.5
Threat Intelligence
EPSS
0.05% (22nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-OPENZEPPELINCONTRACTSUPGRADEABLE-6114712
- published 10 Dec 2023
- disclosed 9 Dec 2023
- credit Unknown
Introduced: 9 Dec 2023
CVE-2023-49798 Open this link in a new tabHow to fix?
Upgrade @openzeppelin/contracts-upgradeable to version 4.9.5 or higher.
Overview
@openzeppelin/contracts-upgradeable is a Secure Smart Contract library for Solidity.
Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to an issue with the Multicall.sol implementation. An attacker can cause unintended duplicate operations, such as asset transfers, by exploiting the fact that all subcalls are executed twice.
References
CVSS Scores
version 3.1