PT-2021-24336 · Unknown · @Openzeppelin/Contracts-Upgradeable+2
Published
2021-12-14
·
Updated
2022-02-09
·
CVE-2021-46320
CVSS v3.1
5.6
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions:
OpenZeppelin versions <=v4.4.0
Description:
Initializer functions that are invoked separate from contract creation, such as minimal proxies, may be reentered if they make an untrusted non-view external call. Normally, once an initializer has finished running, it can never be re-executed. However, an exception to support multiple inheritance made reentrancy possible, breaking the expectation of a single execution. The impact of this issue is believed to be minor, as upgradeable proxies are commonly initialized together with contract creation, where reentrancy is not feasible.
Recommendations:
For OpenZeppelin versions <=v4.4.0, update to version v4.4.1 of
@openzeppelin/contracts and @openzeppelin/contracts-upgradeable to fix the issue.
As a temporary workaround, avoid making untrusted external calls during initialization.Fix
Improper Initialization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openzeppelin Contracts
@Openzeppelin/Contracts-Upgradeable
Openzeppelin