PT-2022-23060 · Openzeppelin · Openzeppelin Contracts

Frangio · Published 2022-08-14 · Updated 2026-03-26 · CVE-2022-35961

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts versions prior to 4.7.3

Description The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This issue affects contracts that implement signature reuse or replay protection by marking the signature itself as used, rather than the signed message or a nonce included in it. A user may submit a previously used signature in a different form, bypassing this protection.

Recommendations For versions prior to 4.7.3, update to version 4.7.3 to resolve the issue. As a temporary workaround, consider modifying the contracts to implement signature reuse or replay protection by marking the signed message or a nonce included in it as used, rather than the signature itself. Restrict access to the ECDSA.recover and ECDSA.tryRecover functions to minimize the risk of exploitation.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

CWE-354

Related Identifiers

CVE-2022-35961

GHSA-4H98-2769-GH6H

GHSA-Q67F-28XG-22RW

Affected Products

Openzeppelin Contracts

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35961.json · Exploit
• https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3610 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-35961 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25793 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33895 · Security Note
• https://osv.dev/vulnerability/GHSA-4h98-2769-gh6h · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q67f-28xg-22rw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35961 · Vendor Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts · Note
• https://github.com/OpenZeppelin/openzeppelin-contracts/commit/d693d89d99325f395182e4f547dbf5ff8e5c3c87 · Note
• https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.7.3 · Note
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-4h98-2769-gh6h · Note
• https://github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85 · Note
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw · Note
• https://github.com/digitalbazaar/forge · Note