CVE-2022-31170 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false
Attackers can cause smart contracts to revert unexpectedly by interacting with non-compliant EIP-165 targets, disrupting contract logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31170?
CVE-2022-31170 is a high-severity denial of service vulnerability in openzeppelin-contracts, published on 21 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning `false`. `ERC165Checker.supportsInterface` is designed to always successfully return a boolean, and under no circumstance revert. However, an incorrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't implement EIP-165 as expected, specifically if it returns a value other than 0 or 1. The contracts that may be affected are those that use `ERC165Checker` to check for support for an interface and then handle the lack of support in a way other than reverting. The issue was patched in version 4.7.1.
Which versions are affected by CVE-2022-31170?
4 open source packages ship an affected version, including @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@openzeppelin/contracts npm | From 4.0.0 | 4.7.1 |
@openzeppelin/contracts npm | From 4.0.0 | 4.7.1 |
@openzeppelin/contracts-upgradeable npm | From 4.0.0 | 4.7.1 |
@openzeppelin/contracts-upgradeable npm | From 4.0.0 | 4.7.1 |
Products include Openzeppelin Contracts.
How do I fix CVE-2022-31170?
Upgrade @openzeppelin/contracts to 4.7.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-31170 being exploited?
There is no known exploitation of CVE-2022-31170 in the wild and no public exploit code.
Other vulnerabilities in openzeppelin-contracts
- CVE-2021-39167 TimelockController vulnerability in OpenZeppelin Contracts
- CVE-2021-39168 TimelockController vulnerability in OpenZeppelin Contracts
- CVE-2021-41264 UUPSUpgradeable vulnerability in OpenZeppelin Contracts
- CVE-2022-35961 ECDSA signature malleability in OpenZeppelin Contracts
- CVE-2022-31198 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts
Sources
Also known as GHSA-qh9x-gcfh-pcrw.