CVE-2023-23940: OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass
Cause isvalidethsignature is missing a call to finalizekeccak after calling verifyethsignature.
Impact As a result, any contract using isvalidethsignature from the account library (such as the EthAccount preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts.
Risk In order to exploit this vulnerability, it is required to control a sequencer or prover since they're the ones executing the hints, being able to inject incorrect keccak results.
Today StarkWare is the only party running both a prover or a sequencer, greatly reducing the risk of exploit.
Patches The issue has been patched in 0.6.1.
For more information If you have any questions or comments about this advisory: Open an issue in the Contracts for Cairo repository Email us at security@openzeppelin.com
Other sources
OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. isvalidethsignature is missing a call to finalizekeccak after calling verifyethsignature. As a result, any contract using isvalidethsignature from the account library (such as the EthAccount preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-23940?
CVE-2023-23940 is a vulnerability in OpenZeppelin Contracts for Cairo, a library for secure smart contract development.
What is the severity of CVE-2023-23940?
The severity of CVE-2023-23940 is medium, with a severity value of 5.3.
Which software is affected by CVE-2023-23940?
OpenZeppelin Contracts for Cairo versions 0.2.0 to 0.6.1 are affected by CVE-2023-23940.
What is the CWE ID for CVE-2023-23940?
The CWE ID for CVE-2023-23940 is 347 and 345.
How can I fix CVE-2023-23940?
To fix CVE-2023-23940, update OpenZeppelin Contracts for Cairo to a version that includes the fix.