CVE-2023-30541: medium-severity vulnerability in openzeppelin-contracts
TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.8%
OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding, the proxy could revert while attempting to decode the arguments from calldata. The probability of an accidental clash is negligible, but one could be caused deliberately and could cause a reduction in availability. The issue has been fixed in version 4.8.3. As a workaround if a function appears to be inaccessible for this reason, it may be possible to craft the calldata such that ABI decoding does not fail at the proxy and the function is properly proxied through.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
OpenZeppelin · openzeppelin-contractsRelated CVEs — openzeppelin-contracts
In the same product, most dangerous first.
CVE-2021-39167CRITICALTimelockController vulnerability in OpenZeppelin ContractsEPSS 1.6%CVE-2021-41264CRITICALUUPSUpgradeable vulnerability in OpenZeppelin ContractsEPSS 1.5%CVE-2022-35915MEDIUMUnbounded gas consumption in @openzeppelin/contractsEPSS 0.8%CVE-2022-31198HIGHGovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contractsEPSS 0.8%CVE-2022-31170HIGH OpenZeppelin Contracts's ERC165Checker may revert instead of returning falseEPSS 0.8%CVE-2024-27094MEDIUMOpenZeppelin Contracts base64 encoding may read from potentially dirty memoryEPSS 0.8%