CVE-2022-31170
Description
OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning `false`. `ERC165Checker.supportsInterface` is designed to always successfully return a boolean, and under no circumstance revert. However, an incorrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't implement EIP-165 as expected, specifically if it returns a value other than 0 or 1. The contracts that may be affected are those that use `ERC165Checker` to check for support for an interface and then handle the lack of support in a way other than reverting. The issue was patched in version 4.7.1.
How to fix
- openzeppelin contracts4.7.1 or later
- @openzeppelin/contracts4.7.1 or later
- @openzeppelin/contracts-upgradeable4.7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openzeppelin contracts | 4.0.0 ≤ v < 4.7.1 | 4.7.1 |
| @openzeppelin/contractsnpm | 4.0.0 ≤ v < 4.7.1 | 4.7.1 |
| @openzeppelin/contracts-upgradeablenpm | 4.0.0 ≤ v < 4.7.1 | 4.7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.