| Package | Affected versions | Patched versions |
|---|---|---|
| contracts | ≥ 2.0.0, < 4.7.2 | 4.7.2 |
| contracts upgradeable | ≥ 3.2.0, < 4.7.2 | 4.7.2 |
| openzeppelin-eth | ≥ 2.0.0 | |
| openzeppelin-solidity | ≥ 2.0.0 | |
| @openzeppelin/contracts | ≥ 2.0.0, < 4.7.2 | 4.7.2 |
| @openzeppelin/contracts-upgradeable | ≥ 3.2.0, < 4.7.2 | 4.7.2 |
| openzeppelin-eth | ≥ 2.0.0, ≤ 2.2.0 | |
| openzeppelin-solidity | ≥ 2.0.0, ≤ 4.6.0 |
The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost.
The issue has been fixed in v4.7.2.
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3587
If you have any questions or comments about this advisory, or need assistance deploying a fix, email us at [email protected].
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free