Executive brief
OpenZeppelin Contracts is a widely-used library providing secure smart contract building blocks, including a proxy pattern for upgradeable contracts. This vulnerability allows function calls in upgraded contracts to fail unexpectedly when their function selectors (4-byte identifiers) clash with the proxy's own selectors. An attacker could deliberately craft such a clash to make certain contract functions inaccessible, causing service disruption or unexpected behavior.
Technical details
The vulnerability exists in TransparentUpgradeableProxy when a function in the implementation contract has a selector that clashes with one of the proxy's own selectors. If the clashing function has an incompatible ABI signature, the proxy attempts to decode arguments from calldata and reverts during this process, preventing proper delegation to the implementation. While accidental selector collisions are statistically negligible, they can be caused deliberately. The issue was fixed in v4.8.3 (v3.2.0 through v4.8.2 are affected). A potential workaround involves crafting specific calldata to bypass the proxy's argument decoding.
Affected products
- OpenZeppelin Contracts 3.2.0 through 4.8.2
- OpenZeppelin Contracts Upgradeable 3.2.0 through 4.8.2
Timeline
- 2023-04-17: disclosed: Advisory published
- 2023-04-17: patched: Fixed in v4.8.3