Log in Start free

Vulnerability · Published Aug 10, 2023 · Assigned by GitHub_M

CVE-2023-40014OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender

Medium 5.3

In plain English

A medium-severity security flaw in openzeppelin-contracts from OpenZeppelin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.7%top 45.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@openzeppelin/contracts4.9.3GHSA-g4vp-m682-qqmp
npm@openzeppelin/contracts-upgradeable4.9.3GHSA-g4vp-m682-qqmp

Affected products (as reported)

VendorProductVersions
OpenZeppelin openzeppelin-contracts >= 4.0.0, < 4.9.3

Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References