CVE-2023-40014: OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender
Impact
OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address(0) in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for MinimalForwarder from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders.
Patches
The problem has been patched in v4.9.3.
Other sources
OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address(0) in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for MinimalForwarder from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-40014?
CVE-2023-40014 is a vulnerability in OpenZeppelin Contracts library versions 4.0.0 to 4.9.3 that may result in `_msgSender` returning `address(0)` in calls originating from a trusted forwarder.
How does the CVE-2023-40014 vulnerability impact OpenZeppelin Contracts?
The CVE-2023-40014 vulnerability impacts OpenZeppelin Contracts by causing the `_msgSender` function to return `address(0)` in calls originating from a trusted forwarder.
What is the severity of CVE-2023-40014?
The severity of CVE-2023-40014 is medium with a CVSS score of 5.3.
Which versions of OpenZeppelin Contracts are affected by CVE-2023-40014?
Versions 4.0.0 to 4.9.3 of OpenZeppelin Contracts are affected by CVE-2023-40014.
How can I fix the CVE-2023-40014 vulnerability?
To fix the CVE-2023-40014 vulnerability, update OpenZeppelin Contracts to version 4.9.3.