CVE-2023-26488: OpenZeppelin Contracts contains Incorrect Calculation
OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the balance as reported by balanceOf. The issue exclusively presents with batches of size 1. The issue has been patched in 4.8.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-26488?
CVE-2023-26488 is a vulnerability in the OpenZeppelin Contracts library that affects the ERC721Consecutive contract.
How does CVE-2023-26488 affect OpenZeppelin Contracts?
CVE-2023-26488 affects OpenZeppelin Contracts by not updating balances when a batch has size 1 and consists of a single token, which can lead to balance overflow during subsequent transfers.
What is the severity of CVE-2023-26488?
The severity of CVE-2023-26488 is medium, with a severity value of 6.5.
How can I fix CVE-2023-26488 in OpenZeppelin Contracts?
To fix CVE-2023-26488 in OpenZeppelin Contracts, upgrade to version 4.8.2 or higher.
Where can I find more information about CVE-2023-26488?
More information about CVE-2023-26488 can be found in the OpenZeppelin Contracts repository and the associated security advisories.