CVE-2022-35916 Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls

Medium 5.3 Published 1 Aug 2022 Updated 23 Apr 2025

Smart contracts using OpenZeppelin Arbitrum L2 utilities incorrectly treat direct EOA calls as cross-chain, potentially bypassing security checks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-35916?

CVE-2022-35916 is a medium-severity vulnerability in openzeppelin-contracts, published on 1 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossChainEnabledArbitrumL2` or `LibArbitrumL2`, will classify direct interactions of externally owned accounts (EOAs) as cross chain calls, even though they are not started on L1. This issue has been patched in v4.7.2. Users are advised to upgrade. There are no known workarounds for this issue.

Weakness: CWE-669

Which versions are affected by CVE-2022-35916?

4 open source packages ship an affected version, including @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. It affects 2 products.

Package	Affected	Fixed in
`@openzeppelin/contracts` npm	From `4.6.0`	`4.7.2`
`@openzeppelin/contracts` npm	From `4.6.0`	`4.7.2`
`@openzeppelin/contracts-upgradeable` npm	From `4.6.0`	`4.7.2`
`@openzeppelin/contracts-upgradeable` npm	From `4.6.0`	`4.7.2`

Products include Openzeppelin Contracts, Openzeppelin Contracts Upgradeable.

How do I fix CVE-2022-35916?

Upgrade @openzeppelin/contracts to 4.7.2 or later.

Is CVE-2022-35916 being exploited?

There is no known exploitation of CVE-2022-35916 in the wild and no public exploit code.

Sources

Also known as GHSA-9j3m-g383-29qr.