GHSA-7j52-6fjp-58gr: @openzeppelin/contracts upgradeable Inconsistent Storage Layout For ERC2771ContextUpgradeable Vulnerability
LOWGHSA-7j52-6fjp-58gr is a LOW inconsistent storage layout for erc2771contextupgradeable vulnerability (General Security Weakness) affecting @openzeppelin/contracts upgradeable libraries in the npm ecosystem. The issue involves inconsistent storage layout for erc2771contextupgradeable. Remediation is available by upgrading affected packages to version 4.3.0.
GHSA-7j52-6fjp-58gr at a Glance
How to Fix GHSA-7j52-6fjp-58gr
To remediate this vulnerability, upgrade all affected @openzeppelin/contracts upgradeable dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @openzeppelin/contracts-upgradeable@4.3.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @openzeppelin/contracts-upgradeableHow to Check if You Are Affected
To determine whether your Node.js application is affected by GHSA-7j52-6fjp-58gr, inspect your project dependencies using npm:
npm ls @openzeppelin/contracts-upgradeableAnalyze the terminal output to locate any version of @openzeppelin/contracts upgradeable in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.3.0), your application is affected.
Note: The npm ls @openzeppelin/contracts-upgradeable command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under General Security Weakness. In @openzeppelin/contracts upgradeable, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-7j52-6fjp-58gr Affected @openzeppelin/contracts upgradeable Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@openzeppelin/contracts-upgradeable
|
npm |
≥ 4.0.0
< 4.3.0
|
4.3.0
|
References
Frequently Asked Questions
What is GHSA-7j52-6fjp-58gr?
Which @openzeppelin/contracts upgradeable versions are affected?
What version fixes GHSA-7j52-6fjp-58gr?
Is @openzeppelin/contracts-upgradeable affected?
What CWE is associated with GHSA-7j52-6fjp-58gr?
How can I check npm dependencies for GHSA-7j52-6fjp-58gr?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-7j52-6fjp-58gr",
"modified" : "2022-03-14T23:22:27Z",
"published" : "2022-03-14T23:22:27Z",
"aliases" : [ ],
"summary" : "Inconsistent storage layout for ERC2771ContextUpgradeable",
"details" : "### Impact\n\nThe storage layout of the ERC2771ContextUpgradeable is not constant between versions. \n- versions `4.0.0`, `4.1.0` and `4.2.0`, the contract has a length of 51 slots. \n- since `4.3.0`, the contract has a length of 50 slots\n- future versions will continue using 50 slots. \n\nThis difference in layout could result in breaking upgrades if someone upgrades from an affected version to a non-affected version. It is thus recommended to be extremely careful when upgrading from a contract that uses ERC2771ContextUpgradeable `<4.3.0` to a newer version that uses `>=4.3.0`.\n\nWe've assessed the instances of this contract found on chain (with publicly verified source code) and notified the corresponding teams of the risk that an upgrade could cause.\n\n### Workarounds\n\nPotentially breaking upgrades would be caught by the OpenZeppelin Upgrades Plugins for Hardhat and Truffle. It is recommended to use this tooling for all your upgrades.\n\nIf you need to upgrade to a newer version of the Upgradeable Contracts library, we recommend copying the previous implementation ERC2771ContextUpgradeable (available in the `release-4.2` branch) and packaging it with your code.\n\n### Reference\n\nhttps://github.com/OpenZeppelin/openzeppelin-transpiler/pull/86\n\n### For more information\n\nIf you have any questions, comments, or need assistance regarding this advisory, email us at [security@openzeppelin.com](mailto:security@openzeppelin.com).\n\nTo submit security reports please use [our bug bounty on Immunefi](https://immunefi.com/bounty/openzeppelin/).\n",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@openzeppelin/contracts-upgradeable"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.0.0"
}, {
"fixed" : "4.3.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/security/advisories/GHSA-7j52-6fjp-58gr"
}, {
"type" : "WEB",
"url" : "https://github.com/OpenZeppelin/openzeppelin-transpiler/pull/86"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable"
} ],
"database_specific" : {
"cwe_ids" : [ ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2022-03-14T23:22:27Z",
"nvd_published_at" : null
}
}