Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 15 September 2021.

Which products and versions are affected?

@openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.1.0,fixed=4.3.2; OpenZeppelin Contracts Upgradeable 4.1.0 through 4.3.1.

Is there a fix for This vulnerability?

Yes. @openzeppelin/contracts-upgradeable (npm): upgrade to 4.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run @openzeppelin/contracts-upgradeable (npm) or OpenZeppelin Contracts Upgradeable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

OpenZeppelin Contracts Upgradeable UUPSUpgradeable initialization vulnerability

Severity: info · Published 2021-09-15

OpenZeppelin Contracts Upgradeable is a library used to build smart contracts that can be upgraded after deployment. A vulnerability in the UUPSUpgradeable pattern allows attackers to exploit uninitialized implementation contracts, potentially compromising the integrity of upgradeable smart contracts that depend on this library. This could lead to unauthorized contract state changes or loss of control over deployed smart contracts.

Technologies: @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts Upgradeable. Vendors: npm, OpenZeppelin.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 15 September 2021.
Which products and versions are affected?: @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.1.0,fixed=4.3.2; OpenZeppelin Contracts Upgradeable 4.1.0 through 4.3.1.
Is there a fix for This vulnerability?: Yes. @openzeppelin/contracts-upgradeable (npm): upgrade to 4.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run @openzeppelin/contracts-upgradeable (npm) or OpenZeppelin Contracts Upgradeable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@openzeppelin/contracts-upgradeable (npm): upgrade to 4.3.2 or later
```
npm install @openzeppelin/contracts-upgradeable@4.3.2
```

Technical details

The vulnerability affects the UUPSUpgradeable pattern in @openzeppelin/contracts-upgradeable versions 4.1.0 through 4.3.1. Upgradeable contracts using UUPSUpgradeable are vulnerable to an attack targeting uninitialized implementation contracts. The root cause stems from insufficient initialization requirements in the implementation contract. The attack vector involves interaction with uninitialized contract instances. Developers can mitigate the issue by explicitly initializing implementation contracts by invoking the initializer function (typically named initialize) before deployment. The vulnerability was patched in version 4.3.2.

Affected products

OpenZeppelin Contracts Upgradeable 4.1.0 through 4.3.1

Timeline

2021-09-15: disclosed
2021-09-15: patched: Fixed in version 4.3.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.