openzeppelin/openzeppelin-contracts · Security
OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4
- GHSA ID
- GHSA-699g-q6qh-q4v8
- CVE ID
- CVE-2023-49798
- Severity
- medium
- Published
- Updated
- CVSS
- 5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS v3
- 5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
Context
Merge conflict resolution issue when porting the v5.0.1 Multicall update to the v4.9 branch caused a duplicated line.
Impact
Versions using Multicall from @openzeppelin/[email protected] and @openzeppelin/[email protected] will execute each subcall twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers.
Patches
The duplicated delegatecall was removed in 4.9.5. The 4.9.4 version is marked as deprecated.
CWEs
- CWE-670 · Always-Incorrect Control Flow Implementation
References
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-699g-q6qh-q4v8 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-49798 ↗
- https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/31f9fb9d171f60b2271b2b9c6f62d43302bf9489 ↗
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/88ac712e06832bce73b41e8166cded2729e25205 ↗
- https://github.com/advisories/GHSA-699g-q6qh-q4v8 ↗