Executive brief
OpenZeppelin Contracts is a widely-used library for building smart contracts on blockchain networks. A flaw in the UUPSUpgradeable proxy pattern allows attackers to take control of uninitialized implementation contracts, potentially compromising all proxy instances that depend on them. This could lead to complete loss of contract control, fund theft, or manipulation of contract behavior across multiple projects.
Technical details
The vulnerability exists in the UUPSUpgradeable proxy implementation (versions 4.1.0–4.3.1) where uninitialized implementation contracts can be exploited. The root cause is that an attacker can invoke the upgradeTo() or upgradeToAndCall() methods directly on an uninitialized implementation contract to redirect proxy instances to a malicious implementation. The attack requires no authentication and is network-reachable, making it easily exploitable. By calling the initializer function on the implementation contract, an attacker can gain ownership and perform unauthorized upgrades. The fix in version 4.3.2 restricts the upgrade mechanism to only function within a proxy context, preventing direct calls to implementation contracts. Workarounds include manually initializing implementation contracts or using a constructor to mark the implementation as initialized at deployment time.
Affected products
- OpenZeppelin @openzeppelin/contracts 4.1.0 to 4.3.1
- OpenZeppelin @openzeppelin/contracts-upgradeable 4.1.0 to 4.3.1
Timeline
- 2021-09-14: disclosed: Security advisory published
- 2021-09-14: patched: Fix released in version 4.3.2
- 2021-09-15: advisory: GHSA-5vp3-v4hc-gx76 published
- 2021-09-09: other: OpenZeppelin team initialized over 150 uninitialized implementation contracts across multiple blockchain networks
References
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-5vp3-v4hc-gx76
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/024cc50df478d2e8f78539819749e94d6df60592
- https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301
- https://github.com/OpenZeppelin/openzeppelin-contracts