Executive brief
OpenZeppelin Contracts Upgradeable is a library used to build smart contracts that can be upgraded after deployment. A vulnerability in the UUPSUpgradeable pattern allows attackers to exploit uninitialized implementation contracts, potentially compromising the integrity of upgradeable smart contracts that depend on this library. This could lead to unauthorized contract state changes or loss of control over deployed smart contracts.
Technical details
The vulnerability affects the UUPSUpgradeable pattern in @openzeppelin/contracts-upgradeable versions 4.1.0 through 4.3.1. Upgradeable contracts using UUPSUpgradeable are vulnerable to an attack targeting uninitialized implementation contracts. The root cause stems from insufficient initialization requirements in the implementation contract. The attack vector involves interaction with uninitialized contract instances. Developers can mitigate the issue by explicitly initializing implementation contracts by invoking the initializer function (typically named initialize) before deployment. The vulnerability was patched in version 4.3.2.
Affected products
- OpenZeppelin Contracts Upgradeable 4.1.0 through 4.3.1
Timeline
- 2021-09-15: disclosed
- 2021-09-15: patched: Fixed in version 4.3.2