Junglewise Threat Intelligence

CVE-2023-49798: OpenZeppelin Contracts duplicated execution in Multicall

CVE-2023-49798 · Severity: low · CVSS 3.1 · Published 2023-12-12

Technologies: @openzeppelin/contracts (npm), OpenZeppelin Contracts, OpenZeppelin Contracts Upgradeable, @openzeppelin/contracts-upgradeable (npm). Vendors: npm, OpenZeppelin.

Executive brief

OpenZeppelin Contracts is a library providing secure, reusable smart contract components used by blockchain developers. Version 4.9.4 contains a merge conflict bug in the Multicall feature that causes subcalls to execute twice, potentially leading to duplicate asset transfers and unintended financial transactions.

Technical details

A merge conflict during porting of the Multicall update from v5.0.1 to the v4.9 branch resulted in a duplicated delegatecall instruction. Versions 4.9.4 of both @openzeppelin/contracts and @openzeppelin/contracts-upgradeable are affected. When Multicall is used, each subcall is executed twice instead of once, enabling unintentional duplicate operations such as asset transfers. The vulnerability is a code-level logic error (CWE-670) that does not require authentication or special network preconditions. It was patched in version 4.9.5, and version 4.9.4 has been marked as deprecated.

Affected products

  • OpenZeppelin Contracts 4.9.4
  • OpenZeppelin Contracts Upgradeable 4.9.4

Timeline

  • 2023-12-08: disclosed
  • 2023-12-12: patched: Fixed in version 4.9.5

References

Related threats