OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4

CAO 7.5CVE-2023-49798 · GHSA-699g-q6qh-q4v8 · Công bố 09/12/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-49798 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng contracts (openzeppelin), contracts upgradeable (openzeppelin), @openzeppelin/contracts.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.54%, cao hơn 45.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.9.5 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
contracts openzeppelin	`= 4.9.4`	Chưa có bản vá
contracts upgradeable openzeppelin	`= 4.9.4`	Chưa có bản vá
@openzeppelin/contracts npm	`≥ 4.9.4, < 4.9.5`	`4.9.5`
@openzeppelin/contracts-upgradeable npm	`≥ 4.9.4, < 4.9.5`	`4.9.5`

Mô tả

Context

Merge conflict resolution issue when porting the v5.0.1 Multicall update to the v4.9 branch caused a duplicated line.

Impact

Versions using Multicall from @openzeppelin/[email protected] and @openzeppelin/[email protected] will execute each subcall twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers.

Patches

The duplicated delegatecall was removed in 4.9.5. The 4.9.4 version is marked as deprecated.

Mô tả của NVD

OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In the version of `Multicall.sol` released in `@openzeppelin/[email protected]` and `@openzeppelin/[email protected]`, all subcalls are executed twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers. The duplicated delegatecall was removed in version 4.9.5. The 4.9.4 version is marked as deprecated. Users are advised to upgrade. There are no known workarounds for this issue.