| Package | Affected versions | Patched versions |
|---|---|---|
| contracts | = 4.9.4 | |
| contracts upgradeable | = 4.9.4 | |
| @openzeppelin/contracts | ≥ 4.9.4, < 4.9.5 | 4.9.5 |
| @openzeppelin/contracts-upgradeable | ≥ 4.9.4, < 4.9.5 | 4.9.5 |
Merge conflict resolution issue when porting the v5.0.1 Multicall update to the v4.9 branch caused a duplicated line.
Versions using Multicall from @openzeppelin/[email protected] and @openzeppelin/[email protected] will execute each subcall twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers.
The duplicated delegatecall was removed in 4.9.5. The 4.9.4 version is marked as deprecated.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free