Executive brief
OpenZeppelin Contracts is a widely-used library providing secure smart contract components for Ethereum and other blockchain platforms. Initializer functions used in proxy-based contract deployments can be re-entered through untrusted external calls, allowing attackers to execute initialization logic multiple times. This breaks a core security guarantee and could lead to contract state corruption or unintended privilege grants in affected applications.
Technical details
This is an improper initialization vulnerability (CWE-665) affecting OpenZeppelin Contracts versions before 4.4.1. The root cause is an exception in the reentrancy guard designed to support multiple inheritance, which allowed initializer functions to be reentered when they invoke untrusted non-view external calls. An attacker can exploit this by triggering a callback during initialization to re-invoke the initializer before it completes. The attack is most practical in minimal proxy scenarios where initialization is decoupled from contract creation. The vulnerability was patched in version 4.4.1 with improved reentrancy protection. The impact is considered minor for upgradeable proxies (the common pattern), since they typically initialize atomically with creation.
Affected products
- OpenZeppelin Contracts >=0 <4.4.1
- OpenZeppelin Contracts Upgradeable >=3.2.0 <4.4.1
CVE identifiers
- CVE-2021-46320
- CVE-2022-39384
Timeline
- 2021-12-14: disclosed
- 2022-02-04: patched: v4.4.1 released
- 2022-02-05: advisory: GHSA-88g8-f5mf-f5rj published