OpenZeppelin Contracts ERC1155Supply token balance inconsistency

Severity: info · Published 2021-11-15

OpenZeppelin Contracts is a library used by developers to build secure smart contracts. The ERC1155Supply extension has a timing issue where token supply is updated after a callback notification is sent, allowing an attacker to observe an artificially low supply during the callback window. This could be exploited in systems that rely on accurate token supply counts to enforce limits or checks.

Technologies: @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts, OpenZeppelin Contracts Upgradeable. Vendors: npm, OpenZeppelin.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Informational severity, published 15 November 2021.
Which products and versions are affected?
@openzeppelin/contracts (npm) SEMVER:introduced=4.2.0,fixed=4.3.3; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.2.0,fixed=4.3.3; OpenZeppelin Contracts 4.2.0 to 4.3.2; OpenZeppelin Contracts Upgradeable 4.2.0 to 4.3.2.
Is there a fix for This vulnerability?
Yes. @openzeppelin/contracts (npm): upgrade to 4.3.3 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected?
Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @openzeppelin/contracts (npm): upgrade to 4.3.3 or later
    npm install @openzeppelin/contracts@4.3.3
  • @openzeppelin/contracts-upgradeable (npm): upgrade to 4.3.3 or later
    npm install @openzeppelin/contracts-upgradeable@4.3.3

Technical details

The vulnerability is a logic error in the ERC1155Supply extension where total supply updates are deferred until after the callback to token receivers completes. During the receiver callback (as mandated by the ERC1155 spec), the reported supply does not yet reflect the tokens just minted, creating a window of inconsistency. An attacker receiving tokens can query the supply and act on the lower reported value before the actual supply is updated. No special privileges or network access are required; exploitation depends on contract-level logic that trusts supply values during callbacks. The issue is fixed in version 4.3.3 of both @openzeppelin/contracts and @openzeppelin/contracts-upgradeable.

Affected products

  • OpenZeppelin Contracts 4.2.0 to 4.3.2
  • OpenZeppelin Contracts-Upgradeable 4.2.0 to 4.3.2

Timeline

  • 2021-11-15: disclosed: Advisory published
  • 2021-11-15: patched: Fix released in version 4.3.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.