Fluid Attacks Database

Description

OpenZeppelin Contracts ERC165Checker unbounded gas consumption

Impact

The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost.

Patches

The issue has been fixed in v4.7.2.

References

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3587

For more information

If you have any questions or comments about this advisory, or need assistance deploying a fix, email us at [email protected].

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
npm	openzeppelin-solidity	>=2.0.0 <=4.6.0	-
npm	@openzeppelin/contracts	>=2.0.0 <4.7.2	4.7.2
npm	@openzeppelin/contracts-upgradeable	>=3.2.0 <4.7.2	4.7.2
npm	openzeppelin-eth	>=2.0.0 <=2.2.0	2.0.2-standalone

Aliases

1. CVE-2022-359152. NVD-2022-359153. OSV-2022-359154. GHSA-7grf-83vw-6f5x5. GCVE-2022-35915

References

1. https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-7grf-83vw-6f5x2. https://github.com/OpenZeppelin/openzeppelin-contracts/pull/35873. https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.7.2

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.