CVE-2021-41264: UUPSUpgradeable vulnerability in OpenZeppelin Contracts
OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. For users unable to upgrade; initialize implementation contracts using UUPSUpgradeable by invoking the initializer function (usually called initialize). An example is provided in the forum.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-41264?
CVE-2021-41264 is a vulnerability in OpenZeppelin Contracts library that affects upgradeable contracts using UUPSUpgradeable and allows for attacks on uninitialized implementation contracts.
How severe is CVE-2021-41264?
CVE-2021-41264 has a severity rating of 9.8 (critical).
Which versions of OpenZeppelin Contracts are affected by CVE-2021-41264?
Versions between 4.1.0 and 4.3.2 of OpenZeppelin Contracts are affected by CVE-2021-41264.
How can I fix CVE-2021-41264?
To fix CVE-2021-41264, upgrade to version 4.3.2 of @openzeppelin/contracts.
Where can I find more information about CVE-2021-41264?
More information about CVE-2021-41264 can be found in the OpenZeppelin forum and GitHub repositories.