Vulnerability · Published Feb 3, 2023 · Assigned by GitHub_M
CVE-2023-23940OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass
Medium 6.4
In plain English
A medium-severity insufficient verification of data authenticity in cairo-contracts from OpenZeppelin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | openzeppelin-cairo-contracts | 0.6.1 | GHSA-626q-v9j4-mcp4 |
| PyPI | openzeppelin-cairo-contracts | 0.6.1 | PYSEC-2023-39 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenZeppelin | cairo-contracts | >= 0.2.0, < 0.6.1 |
Weakness: CWE-347, CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L