Executive brief
OpenZeppelin Confidential Contracts is a library for building privacy-preserving smart contracts on encrypted blockchains. A vulnerability in the VestingWalletConfidential and ERC7984 components allows a malicious token or recipient to bypass access controls and extract sensitive encrypted data (account balances and boolean values) without authorization. While no funds are directly stolen, attackers gain unauthorized visibility into private financial information that applications rely on to maintain confidentiality.
Technical details
The vulnerability stems from two components failing to validate ACL (access control list) authorization on encrypted handles returned by untrusted external parties. In VestingWalletConfidential, a malicious token passed to the release() function can return an alternative handle in confidentialBalanceOf(), allowing the attacker to extract information about any euint64 handle accessible to the vesting wallet. In ERC7984, the transfer callback accepts an ebool return value from the recipient without verifying ACL access, permitting plaintext recovery of the value. Patches validate ACL access before using returned handles in versions 0.3.2, 0.4.2, and 0.5.2.
Affected products
- OpenZeppelin Confidential Contracts < 0.3.2, >= 0.4.0-rc.0 and < 0.4.2, >= 0.5.0-rc.0 and < 0.5.2
Timeline
- 2026-09-25: disclosed: Vulnerability published as GHSA-29h2-jr22-frmh
- 2026-09-25: patched: Fixed in versions 0.3.2, 0.4.2, and 0.5.2