Skip to content
Log inStart free trial

GHSA-mx2q-35m2-x2rh CVE-2023-30541

OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated

Medium npm
Severity
5.3 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
0.81%
Chance of exploitation in the next 30 days. Higher than 57.00% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-436 Interpretation Conflict
Fix
Available
2 packages have a fixed version

Description

Impact

A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding, the proxy could revert while attempting to decode the arguments from calldata.

The probability of an accidental clash is negligible, but one could be caused deliberately.

Patches

The issue has been fixed in v4.8.3.

Workarounds

If a function appears to be inaccessible for this reason, it may be possible to craft the calldata such that ABI decoding does not fail at the proxy and the function is properly proxied through.

References

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4154

Affected versions

npm

PackageVulnerableFixed in
@openzeppelin/contracts
>= 3.2.0, < 4.8.3
4.8.3
@openzeppelin/contracts-upgradeable
>= 3.2.0, < 4.8.3
4.8.3

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

@openzeppelin/contracts npm → 4.8.3

npm
npm install @openzeppelin/contracts@4.8.3
yarn
yarn add @openzeppelin/contracts@4.8.3
pnpm
pnpm add @openzeppelin/contracts@4.8.3

@openzeppelin/contracts-upgradeable npm → 4.8.3

npm
npm install @openzeppelin/contracts-upgradeable@4.8.3
yarn
yarn add @openzeppelin/contracts-upgradeable@4.8.3
pnpm
pnpm add @openzeppelin/contracts-upgradeable@4.8.3

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Weakness

CWE-436: Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-9rcw-c2f9-2j55
OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers
Medium Also affects @openzeppelin/contracts
GHSA-9vx6-7xxf-x967
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
High Also affects @openzeppelin/contracts
GHSA-699g-q6qh-q4v8
OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4
High Also affects @openzeppelin/contracts
GHSA-g4vp-m682-qqmp
OpenZeppelin Contracts vulnerable to Improper Escaping of Output
Medium Also affects @openzeppelin/contracts
GHSA-wprv-93r4-jj2p
OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees
Medium Also affects @openzeppelin/contracts
GHSA-5h3x-9wvq-w4m2
OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning
Medium Also affects @openzeppelin/contracts
GHSA-93hq-5wgc-jc82
GovernorCompatibilityBravo may trim proposal calldata
High Also affects @openzeppelin/contracts
GHSA-878m-3g6q-594q
OpenZeppelin Contracts contains Incorrect Calculation
Medium Also affects @openzeppelin/contracts
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor