CVE-2023-49798 Duplicated execution of subcalls in OpenZeppelin Contracts

Medium 5.9 Published 8 Dec 2023 Updated 2 Aug 2024

A duplication bug in OpenZeppelin Contracts causes subcalls to execute twice, leading to unintended duplicate asset transfers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-49798?

CVE-2023-49798 is a medium-severity vulnerability in openzeppelin-contracts, published on 8 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In the version of `Multicall.sol` released in `@openzeppelin/[email protected]` and `@openzeppelin/[email protected]`, all subcalls are executed twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers. The duplicated delegatecall was removed in version 4.9.5. The 4.9.4 version is marked as deprecated. Users are advised to upgrade. There are no known workarounds for this issue.

Weakness: CWE-670

Which versions are affected by CVE-2023-49798?

4 open source packages ship an affected version, including @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. It affects 2 products.

Package	Affected	Fixed in
`@openzeppelin/contracts` npm	From `4.9.4`	`4.9.5`
`@openzeppelin/contracts` npm	From `4.9.4`	`4.9.5`
`@openzeppelin/contracts-upgradeable` npm	From `4.9.4`	`4.9.5`
`@openzeppelin/contracts-upgradeable` npm	From `4.9.4`	`4.9.5`

Products include Openzeppelin Contracts, Openzeppelin Contracts Upgradeable.

How do I fix CVE-2023-49798?

Upgrade @openzeppelin/contracts to 4.9.5 or later.

Is CVE-2023-49798 being exploited?

There is no known exploitation of CVE-2023-49798 in the wild and no public exploit code.

Sources

Also known as GHSA-699g-q6qh-q4v8.