PT-2022-37397 · Openzeppelin · Openzeppelin Contracts For Cairo

Published 2022-07-15 · Updated 2022-07-15

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts for Cairo version 0.2.0

Description The issue affects account contracts, rendering them unusable on live networks. This problem impacts all accounts, including vanilla and ethereum flavors, in the v0.2.0 release that are not whitelisted on StarkNet mainnet. Only goerli deployments of v0.2.0 accounts are affected. The faulty behavior is not observed in StarkNet's testing framework.

Recommendations For version 0.2.0, update to version 0.2.1 to resolve the issue.

Fix

Related Identifiers

PYSEC-2022-43143

Affected Products

Openzeppelin Contracts For Cairo

References · 7

• https://osv.dev/vulnerability/PYSEC-2022-43143 · Vendor Advisory
• https://github.com/OpenZeppelin/cairo-contracts/issues/386 · Note
• https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.1 · Note
• https://github.com/OpenZeppelin/cairo-contracts/pull/387 · Note
• https://github.com/OpenZeppelin/cairo-contracts/commit/2cd60279c3332285d47edf9ee3888b71257acdc9 · Note
• https://github.com/OpenZeppelin/cairo-contracts/blob/release-0.2.0/src/openzeppelin/account/library.cairo#L203 · Note
• https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-8mjr-jr5h-q2xr · Note