# CVE-2023-34459: OpenZeppelin Contracts MerkleProof multiproof verification bypass

Source: https://junglewise.ai/threats/cve-2023-34459-openzeppelin-contracts-merkleproof-multiproof-verification-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-06-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-34459 · Severity: low · CVSS 3.1 · Published 2023-06-19

OpenZeppelin Contracts is a widely-used library providing cryptographic and access-control building blocks for blockchain applications. The MerkleProof multiproof verification functions contain a flaw that allows an attacker to forge valid proofs for arbitrary data in certain merkle trees, potentially enabling unauthorized claims or transactions in smart contracts that rely on this verification mechanism.

Technologies: [@openzeppelin/contracts (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts), [@openzeppelin/contracts-upgradeable (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts-upgradeable), [OpenZeppelin Contracts](https://junglewise.ai/threats/technologies/contracts), [OpenZeppelin Contracts Upgradeable](https://junglewise.ai/threats/technologies/contracts-upgradeable). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [OpenZeppelin](https://junglewise.ai/threats/vendors/openzeppelin).

## Quick answers

**Is CVE-2023-34459 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-34459 being exploited in the wild.

**How severe is CVE-2023-34459?** Low severity, with a CVSS score of 3.1, published 19 June 2023.

**Which products and versions are affected?** @openzeppelin/contracts (npm) SEMVER:introduced=4.7.0,fixed=4.9.2; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.7.0,fixed=4.9.2; OpenZeppelin Contracts 4.7.0 to 4.9.1; OpenZeppelin Contracts Upgradeable 4.7.0 to 4.9.1.

**Is there a fix for CVE-2023-34459?** Yes. @openzeppelin/contracts (npm): upgrade to 4.9.2 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-34459 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-34459?** Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @openzeppelin/contracts (npm): upgrade to 4.9.2 or later

  ```sh
  npm install @openzeppelin/contracts@4.9.2
  ```

- @openzeppelin/contracts-upgradeable (npm): upgrade to 4.9.2 or later

  ```sh
  npm install @openzeppelin/contracts-upgradeable@4.9.2
  ```


## Technical details

The vulnerability exists in the verifyMultiProof, verifyMultiProofCalldata, processMultiProof, and processMultiProofCalldata functions when processing merkle trees that contain a node with value 0 at depth 1 (directly below the root). This allows an attacker to construct valid multiproofs for arbitrary leaf sets. The flaw is most likely to occur inadvertently in balanced trees with 3 or fewer unhashed leaves, or may be deliberately introduced by a malicious tree builder. Single-leaf proof functions and multiproofs using hashed leaves are not affected. The vulnerability was patched in version 4.9.2; affected versions include 4.7.0 through 4.9.1.

## Affected products

- OpenZeppelin Contracts 4.7.0 to 4.9.1
- OpenZeppelin Contracts Upgradeable 4.7.0 to 4.9.1

## Identifiers

- CVE-2023-34459
- GHSA-wprv-93r4-jj2p

## Timeline

- 2023-06-16: disclosed: Advisory published on GitHub
- 2023-06-19: patched: Patch released in version 4.9.2

## References

- [https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-wprv-93r4-jj2p](https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-wprv-93r4-jj2p)

## Related threats

- [OpenZeppelin Contracts information disclosure in VestingWalletConfidential](https://junglewise.ai/threats/openzeppelin-confidential-contracts-vestingwalletconfidential-a-14aa72cf)
- [OpenZeppelin Contracts out-of-bounds memory access in Bytes.lastIndexOf](https://junglewise.ai/threats/cve-2025-54070-openzeppelin-contracts-out-of-bounds-memory-access-in-bytes)
- [OpenZeppelin Contracts base64 encoding reads from dirty memory](https://junglewise.ai/threats/cve-2024-27094-openzeppelin-contracts-base64-encoding-reads-from-dirty-memory)
- [OpenZeppelin Contracts duplicated execution in Multicall](https://junglewise.ai/threats/cve-2023-49798-openzeppelin-contracts-duplicated-execution-in-multicall)
- [OpenZeppelin Contracts improper escaping in ERC2771Context](https://junglewise.ai/threats/cve-2023-40014-openzeppelin-contracts-improper-escaping-in-erc2771context)