CVE-2022-31172
Description
OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. `SignatureChecker.isValidSignatureNow` is not expected to revert. However, an incorrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't implement EIP-1271 as expected. The contracts that may be affected are those that use `SignatureChecker` to check the validity of a signature and handle invalid signatures in a way other than reverting. The issue was patched in version 4.7.1.
How to fix
- openzeppelin contracts4.7.1 or later
- @openzeppelin/contracts4.7.1 or later
- @openzeppelin/contracts-upgradeable4.7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openzeppelin contracts | 4.1.0 ≤ v < 4.7.1 | 4.7.1 |
| @openzeppelin/contractsnpm | 4.1.0 ≤ v < 4.7.1 | 4.7.1 |
| @openzeppelin/contracts-upgradeablenpm | 4.1.0 ≤ v < 4.7.1 | 4.7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.