CVE-2023-49798: Duplicated execution of subcalls in OpenZeppelin Contracts

Published Dec 8, 2023

Updated

Context Merge conflict resolution issue when porting the v5.0.1 Multicall update to the v4.9 branch caused a duplicated line.

Impact Versions using Multicall from @openzeppelin/contracts@4.9.4 and @openzeppelin/contracts-upgradeable@4.9.4 will execute each subcall twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers.

Patches The duplicated delegatecall was removed in 4.9.5. The 4.9.4 version is marked as deprecated.

Other sources

OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In the version of Multicall.sol released in @openzeppelin/contracts@4.9.4 and @openzeppelin/contracts-upgradeable@4.9.4, all subcalls are executed twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers. The duplicated delegatecall was removed in version 4.9.5. The 4.9.4 version is marked as deprecated. Users are advised to upgrade. There are no known workarounds for this issue.

— MITRE

Affected Software

4 affected componentsFixes available

npm/@openzeppelin/contracts-upgradeable=4.9.4

4.9.5

npm/@openzeppelin/contracts=4.9.4

4.9.5

OpenZeppelin Contracts Node.js=4.9.4

OpenZeppelin Contracts Upgradeable Node.js=4.9.4

Remediation

Patch Available

https://github.com/OpenZeppelin/openzeppelin-contracts/commit/88ac712e06832bce73b41e8166cded2729e25205

Event History

Dec 8, 2023

CVE Published

via MITRE·11:35 PM

Data Sourced

via MITRE·11:35 PM

DescriptionSeverityWeakness

Dec 12, 2023

Advisory Published

12:49 AM

Frequently Asked Questions

What is the severity of CVE-2023-49798?

CVE-2023-49798 is considered to have a high severity due to the potential for unexpected behavior in contract execution.

How do I fix CVE-2023-49798?

To fix CVE-2023-49798, upgrade to version 4.9.5 of the affected packages @openzeppelin/contracts and @openzeppelin/contracts-upgradeable.

Which versions are affected by CVE-2023-49798?

CVE-2023-49798 affects version 4.9.4 of both @openzeppelin/contracts and @openzeppelin/contracts-upgradeable.

What is the impact of CVE-2023-49798?

The impact of CVE-2023-49798 includes the potential for executing unintended subcalls in contracts using Multicall.

How can I verify if I am affected by CVE-2023-49798?

You can verify if you are affected by checking the version of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable to see if they are at 4.9.4.