Executive brief
OpenZeppelin Contracts is a library used by developers to build secure smart contracts. The ERC1155Supply extension has a timing issue where token supply is updated after a callback notification is sent, allowing an attacker to observe an artificially low supply during the callback window. This could be exploited in systems that rely on accurate token supply counts to enforce limits or checks.
Technical details
The vulnerability is a logic error in the ERC1155Supply extension where total supply updates are deferred until after the callback to token receivers completes. During the receiver callback (as mandated by the ERC1155 spec), the reported supply does not yet reflect the tokens just minted, creating a window of inconsistency. An attacker receiving tokens can query the supply and act on the lower reported value before the actual supply is updated. No special privileges or network access are required; exploitation depends on contract-level logic that trusts supply values during callbacks. The issue is fixed in version 4.3.3 of both @openzeppelin/contracts and @openzeppelin/contracts-upgradeable.
Affected products
- OpenZeppelin Contracts 4.2.0 to 4.3.2
- OpenZeppelin Contracts-Upgradeable 4.2.0 to 4.3.2
Timeline
- 2021-11-15: disclosed: Advisory published
- 2021-11-15: patched: Fix released in version 4.3.3