Executive brief
OpenZeppelin Contracts is a widely-used library providing secure implementations of Ethereum smart contract standards. The ERC165Checker utility is designed to safely verify whether a smart contract supports a given interface; however, a flaw in how it decodes responses can cause it to revert instead of returning false when checking contracts that return malformed interface support responses. Applications relying on this utility to gracefully handle unsupported interfaces may crash unexpectedly, disrupting contract interactions and potentially enabling denial-of-service attacks.
Technical details
The ERC165Checker.supportsInterface function in OpenZeppelin Contracts (versions 4.0.0 to 4.7.0) contains a logic error in how it uses Solidity 0.8's abi.decode to process interface support responses. The function makes an incorrect assumption about the return value handling, causing it to revert when a target contract returns a value other than 0 or 1 (the only valid boolean encodings), rather than gracefully returning false. This occurs during low-level ABI decoding and affects any contract that relies on ERC165Checker to safely probe for interface support without reverting. Applications using ERC165Checker to handle graceful fallback logic when interface support is absent become vulnerable to denial of service, as the probe itself may crash. The vulnerability was patched in version 4.7.1.
Affected products
- OpenZeppelin Contracts >=4.0.0, <4.7.1
- OpenZeppelin Contracts Upgradeable >=4.0.0, <4.7.1
Timeline
- 2022-07-21: disclosed: Vulnerability disclosed via GitHub Security Advisory GHSA-qh9x-gcfh-pcrw
- 2022-07-21: patched: Fixed in OpenZeppelin Contracts 4.7.1