Executive brief
OpenZeppelin Contracts is a widely-used library for building secure smart contracts on blockchain networks. When using the ERC2771Context module with a custom trusted forwarder, a logic flaw can cause the sender address to be incorrectly resolved as zero in certain conditions, potentially leading to authentication bypass or authorization failures in dependent applications.
Technical details
The vulnerability exists in ERC2771Context (versions 4.0.0 through 4.9.2) and stems from improper escaping or validation of calldata when extracting the message sender from a trusted forwarder. When a custom forwarder initiates a call with calldata shorter than 20 bytes, the _msgSender() function may incorrectly return address(0) instead of the legitimate sender address. This is classified as CWE-116 (Improper Encoding or Escaping of Output). The issue requires use of a non-standard forwarder implementation; OpenZeppelin's own MinimalForwarder and known production forwarders are unaffected. The vulnerability was patched in version 4.9.3.
Affected products
- OpenZeppelin Contracts >=4.0.0 to <4.9.3
- OpenZeppelin Contracts Upgradeable >=4.0.0 to <4.9.3
Timeline
- 2023-08-10: disclosed: Vulnerability publicly disclosed
- 2023-08-11: patched: Patch released in version 4.9.3