Executive brief
OpenZeppelin Contracts provides reusable Solidity smart contract components used to secure blockchain applications. A vulnerability in the TimelockController—a contract that enforces time delays on sensitive operations—allowed actors with executor privileges to bypass security controls and seize complete control of the timelock, including all assets and functions protected by it. This could enable complete compromise of governance systems and theft of funds.
Technical details
The vulnerability is a privilege escalation (CWE-266) in TimelockController. An attacker with the executor role could reset the delay parameter to 0 and escalate their privileges to gain unrestricted access to all assets and functions held in the contract. The risk is particularly severe if the executor role is configured as "open," allowing any network-accessible caller to assume the executor role without authentication. The fix is available in OpenZeppelin Contracts 4.3.1, 3.4.2, and 3.4.2-solc-0.7. Deployed instances must be migrated to patched versions by re-deploying the contract and transferring all assets and roles.
Affected products
- OpenZeppelin Contracts 4.0.0 through 4.3.0, 3.3.0 through 3.4.1, 3.3.0-solc-0.7, 3.4.0-solc-0.7, 3.4.1-solc-0.7-2
- OpenZeppelin Contracts Upgradeable 4.0.0 through 4.3.0, 3.3.0 through 3.4.1, 3.3.0-solc-0.7, 3.4.0-solc-0.7, 3.4.1-solc-0.7-2
Timeline
- 2021-08-27: disclosed: Publicly disclosed via GitHub advisory
- 2021-08-27: patched: Patches released in versions 4.3.1, 3.4.2, and 3.4.2-solc-0.7