CVE-2023-23940
Description
OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.
How to fix
- openzeppelin contracts0.6.1 or later
- openzeppelin-cairo-contracts0.6.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openzeppelin contracts | 0.2.0 ≤ v < 0.6.1 | 0.6.1 |
| openzeppelin-cairo-contractsPyPI | 0.2.0 ≤ v < 0.6.1 | 0.6.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.