# CVE-2022-31172: OpenZeppelin Contracts SignatureChecker unexpected revert on invalid EIP-1271 signers

Source: https://junglewise.ai/threats/cve-2022-31172-openzeppelin-contracts-signaturechecker-unexpected-revert-on  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-07-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-31172 · Severity: low · CVSS 3.1 · Published 2022-07-21

OpenZeppelin Contracts provides a widely-used library for secure Ethereum smart contract development, including signature validation functions. A logic error in the SignatureChecker component can cause it to unexpectedly revert when validating signatures from contracts that don't properly implement the EIP-1271 standard, potentially breaking applications that rely on graceful handling of invalid signatures rather than exceptions.

Technologies: [@openzeppelin/contracts (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts), [@openzeppelin/contracts-upgradeable (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts-upgradeable), [OpenZeppelin Contracts](https://junglewise.ai/threats/technologies/contracts), [OpenZeppelin Contracts Upgradeable](https://junglewise.ai/threats/technologies/contracts-upgradeable). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [OpenZeppelin](https://junglewise.ai/threats/vendors/openzeppelin).

## Quick answers

**Is CVE-2022-31172 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-31172 being exploited in the wild.

**How severe is CVE-2022-31172?** Low severity, with a CVSS score of 3.1, published 21 July 2022.

**Which products and versions are affected?** @openzeppelin/contracts (npm) SEMVER:introduced=4.1.0,fixed=4.7.1; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.1.0,fixed=4.7.1; OpenZeppelin Contracts >=4.1.0, <4.7.1.

**Is there a fix for CVE-2022-31172?** Yes. @openzeppelin/contracts (npm): upgrade to 4.7.1 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-31172 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-31172?** Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @openzeppelin/contracts (npm): upgrade to 4.7.1 or later

  ```sh
  npm install @openzeppelin/contracts@4.7.1
  ```

- @openzeppelin/contracts-upgradeable (npm): upgrade to 4.7.1 or later

  ```sh
  npm install @openzeppelin/contracts-upgradeable@4.7.1
  ```


## Technical details

The vulnerability exists in OpenZeppelin Contracts' SignatureChecker.isValidSignatureNow function, which is designed to validate EIP-1271 signatures without reverting. However, a behavioral change in Solidity 0.8's abi.decode—which now reverts when raw bytes data overflows the target type—was not accounted for in the implementation. When SignatureChecker invokes abi.decode on a response from a contract that doesn't properly implement EIP-1271, the decode operation can revert unexpectedly. This affects applications that use SignatureChecker and expect to handle invalid signatures through normal control flow rather than exception handling. The fix was released in version 4.7.1, which properly handles abi.decode reverts using try-catch mechanisms or alternative decoding strategies.

## Affected products

- OpenZeppelin @openzeppelin/contracts >=4.1.0, <4.7.1
- OpenZeppelin @openzeppelin/contracts-upgradeable >=4.1.0, <4.7.1

## Identifiers

- CVE-2022-31172
- GHSA-4g63-c64m-25w9

## Timeline

- 2022-07-21: disclosed: Advisory published
- 2022-07-18: patched: Fix merged in PR #3552

## References

- [https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-4g63-c64m-25w9](https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-4g63-c64m-25w9)
- [https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552)

## Related threats

- [OpenZeppelin Contracts information disclosure in VestingWalletConfidential](https://junglewise.ai/threats/openzeppelin-confidential-contracts-vestingwalletconfidential-a-14aa72cf)
- [OpenZeppelin Contracts out-of-bounds memory access in Bytes.lastIndexOf](https://junglewise.ai/threats/cve-2025-54070-openzeppelin-contracts-out-of-bounds-memory-access-in-bytes)
- [OpenZeppelin Contracts base64 encoding reads from dirty memory](https://junglewise.ai/threats/cve-2024-27094-openzeppelin-contracts-base64-encoding-reads-from-dirty-memory)
- [OpenZeppelin Contracts duplicated execution in Multicall](https://junglewise.ai/threats/cve-2023-49798-openzeppelin-contracts-duplicated-execution-in-multicall)
- [OpenZeppelin Contracts improper escaping in ERC2771Context](https://junglewise.ai/threats/cve-2023-40014-openzeppelin-contracts-improper-escaping-in-erc2771context)