CVE-2021-46320: OpenZeppelin Contracts initializer reentrancy may lead to double initialization

CVE-2021-46320 · Severity: low · CVSS 3.1 · Published 2021-12-14

OpenZeppelin Contracts is a widely-used library providing secure smart contract components for Ethereum and other blockchain platforms. Initializer functions used in proxy-based contract deployments can be re-entered through untrusted external calls, allowing attackers to execute initialization logic multiple times. This breaks a core security guarantee and could lead to contract state corruption or unintended privilege grants in affected applications.

Technologies: @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts, OpenZeppelin Contracts Upgradeable. Vendors: npm, OpenZeppelin.

Quick answers

Is CVE-2021-46320 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-46320 being exploited in the wild.
How severe is CVE-2021-46320?
Low severity, with a CVSS score of 3.1, published 14 December 2021.
Which products and versions are affected?
@openzeppelin/contracts (npm) SEMVER:introduced=0,fixed=4.4.1, SEMVER:introduced=3.2.0,fixed=4.4.1; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=3.2.0,fixed=4.4.1; OpenZeppelin Contracts >=0 <4.4.1; OpenZeppelin Contracts Upgradeable >=3.2.0 <4.4.1.
Is there a fix for CVE-2021-46320?
Yes. @openzeppelin/contracts (npm): upgrade to 4.4.1 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-46320 attacked?
It is attacked over the network.
Am I affected by CVE-2021-46320?
Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @openzeppelin/contracts (npm): upgrade to 4.4.1 or later
    npm install @openzeppelin/contracts@4.4.1
  • @openzeppelin/contracts-upgradeable (npm): upgrade to 4.4.1 or later
    npm install @openzeppelin/contracts-upgradeable@4.4.1

Technical details

This is an improper initialization vulnerability (CWE-665) affecting OpenZeppelin Contracts versions before 4.4.1. The root cause is an exception in the reentrancy guard designed to support multiple inheritance, which allowed initializer functions to be reentered when they invoke untrusted non-view external calls. An attacker can exploit this by triggering a callback during initialization to re-invoke the initializer before it completes. The attack is most practical in minimal proxy scenarios where initialization is decoupled from contract creation. The vulnerability was patched in version 4.4.1 with improved reentrancy protection. The impact is considered minor for upgradeable proxies (the common pattern), since they typically initialize atomically with creation.

Affected products

  • OpenZeppelin Contracts >=0 <4.4.1
  • OpenZeppelin Contracts Upgradeable >=3.2.0 <4.4.1

Identifiers

  • CVE-2021-46320
  • CVE-2022-39384
  • GHSA-88g8-f5mf-f5rj
  • GHSA-9c22-pwxw-p6hx

Timeline

  • 2021-12-14: disclosed
  • 2022-02-04: patched: v4.4.1 released
  • 2022-02-05: advisory: GHSA-88g8-f5mf-f5rj published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.