Executive brief
OpenZeppelin Contracts Upgradeable is a library providing secure, upgradeable smart contracts for Ethereum and other blockchains. A change in the storage layout of the ERC2771ContextUpgradeable contract between versions 4.0–4.2 (51 slots) and 4.3+ (50 slots) can cause smart contract upgrades to fail or behave unexpectedly if developers upgrade without accounting for the layout difference. Projects using this library must carefully plan upgrades to avoid breaking their deployed contracts.
Technical details
The ERC2771ContextUpgradeable contract in OpenZeppelin Contracts Upgradeable versions 4.0.0, 4.1.0, and 4.2.0 uses 51 storage slots, while version 4.3.0 and later use 50 slots. This change in storage layout is incompatible with upgradeable contract patterns used in Ethereum smart contracts, which rely on consistent storage structure to safely upgrade implementations. When an existing deployed proxy contract using version <4.3.0 is upgraded to >=4.3.0, the differing storage layout can cause data corruption or unexpected behavior. The vulnerability affects any project that upgrades ERC2771ContextUpgradeable without accounting for the layout change. OpenZeppelin recommends using their Upgrades Plugins for Hardhat and Truffle to detect such issues, or manually copying the older implementation as a workaround.
Affected products
- OpenZeppelin Contracts Upgradeable >=4.0.0, <4.3.0
Timeline
- 2022-03-14: disclosed
- 2022-03-14: patched: Fixed in version 4.3.0