Executive brief
OpenZeppelin Contracts is a widely-used library that provides secure, tested smart contract components for blockchain applications. TimelockController is a contract that enforces time delays on sensitive operations to prevent unauthorized changes. A vulnerability allowed accounts with executor privileges to bypass the timelock delay and gain unrestricted control over assets, potentially draining funds or transferring ownership of blockchain-based systems using this component.
Technical details
The vulnerability is a privilege escalation flaw (CWE-266) in OpenZeppelin's TimelockController contract. An actor with the executor role could reset the timelock delay to 0 and escalate their privileges to gain immediate unrestricted access to assets. If the executor role was configured as "open" (meaning anyone can assume it), an attacker could exploit this remotely without authentication. The root cause involves incorrect privilege assignment logic that failed to enforce timelock constraints on delay-reset operations. Patches were released in versions 4.3.1, 3.4.2, and 3.4.2-solc-0.7; deployed instances required migration of assets and roles to patched versions.
Affected products
- OpenZeppelin Contracts >=4.0.0, <=4.3.0; >=3.3.0, <=3.4.1
- OpenZeppelin Contracts Upgradeable >=4.0.0, <=4.3.0; >=3.3.0, <=3.4.1
Timeline
- 2021-08-26: disclosed: Advisory published by OpenZeppelin
- 2021-08-26: patched: Patches released in versions 4.3.1, 3.4.2, 3.4.2-solc-0.7
- 2021-08-27: other: CVE-2021-39168 and GHSA-vrw4-w73r-6mm8 published