Executive brief
OpenZeppelin Contracts is a library providing secure, reusable smart contract components used by blockchain developers. Version 4.9.4 contains a merge conflict bug in the Multicall feature that causes subcalls to execute twice, potentially leading to duplicate asset transfers and unintended financial transactions.
Technical details
A merge conflict during porting of the Multicall update from v5.0.1 to the v4.9 branch resulted in a duplicated delegatecall instruction. Versions 4.9.4 of both @openzeppelin/contracts and @openzeppelin/contracts-upgradeable are affected. When Multicall is used, each subcall is executed twice instead of once, enabling unintentional duplicate operations such as asset transfers. The vulnerability is a code-level logic error (CWE-670) that does not require authentication or special network preconditions. It was patched in version 4.9.5, and version 4.9.4 has been marked as deprecated.
Affected products
- OpenZeppelin Contracts 4.9.4
- OpenZeppelin Contracts Upgradeable 4.9.4
Timeline
- 2023-12-08: disclosed
- 2023-12-12: patched: Fixed in version 4.9.5