CVE-2023-26488
Medium
Description
OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the balance as reported by `balanceOf`. The issue exclusively presents with batches of size 1. The issue has been patched in 4.8.2.
SeverityMedium
CVSS6.5
Exploit probability—
ProductOpenzeppelin Contracts
PublishedMar 3, 2023
First seenMar 3, 2023
Weakness typeCWE-682CWE-682
How to fix
Update
- openzeppelin contracts4.8.2 or later
- openzeppelin contracts_upgradeable4.8.2 or later
- @openzeppelin/contracts4.8.2 or later
- @openzeppelin/contracts-upgradeable4.8.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openzeppelin contracts | 4.8.0 ≤ v < 4.8.2 | 4.8.2 |
| openzeppelin contracts_upgradeable | 4.8.0 ≤ v < 4.8.2 | 4.8.2 |
| @openzeppelin/contractsnpm | 4.8.0 ≤ v < 4.8.2 | 4.8.2 |
| @openzeppelin/contracts-upgradeablenpm | 4.8.0 ≤ v < 4.8.2 | 4.8.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.