fix(deps): update dependency @openzeppelin/contracts-upgradeable to v4.9.5 [security] #3185
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
…4.9.5 [security] | datasource | package | from | to | | ---------- | ----------------------------------- | ----- | ----- | | npm | @openzeppelin/contracts-upgradeable | 4.9.3 | 4.9.5 | Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
github-actions
bot
added
M-contracts
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #3185 +/- ##
===================================================
- Coverage 41.54443% 41.10511% -0.43932%
===================================================
Files 460 454 -6
Lines 25770 25554 -216
Branches 357 293 -64
===================================================
- Hits 10706 10504 -202
+ Misses 14326 14312 -14
Partials 738 738
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Deploying sanguine-fe with
|
| Latest commit: |
1124061
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://4f92691f.sanguine-fe.pages.dev |
| Branch Preview URL: | https://renovate-contracts-core-npm-t90m.sanguine-fe.pages.dev |
Bundle ReportChanges will decrease total bundle size by 150.12kB (-0.42%) ⬇️. This is within the configured threshold ✅ Detailed changes
ℹ️ *Bundle size includes cached data from a previous commit |
|
Closing as not relevant |
github-actions
bot
deleted the
renovate/contracts-core-npm-openzeppelin-contracts-upgradeable-vulnerability
branch
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update ( If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
This PR contains the following updates:
4.9.3->4.9.5Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2022-31170
Impact
ERC165Checker.supportsInterfaceis designed to always successfully return a boolean, and under no circumstance revert. However, an incorrect assumption about Solidity 0.8'sabi.decodeallows some cases to revert, given a target contract that doesn't implement EIP-165 as expected, specifically if it returns a value other than 0 or 1.The contracts that may be affected are those that use
ERC165Checkerto check for support for an interface and then handle the lack of support in a way other than reverting.Patches
The issue was patched in 4.7.1.
References
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552
For more information
If you have any questions or comments about this advisory, or need assistance deploying the fix, email us at [email protected].
CVE-2022-31172
Impact
SignatureChecker.isValidSignatureNowis not expected to revert. However, an incorrect assumption about Solidity 0.8'sabi.decodeallows some cases to revert, given a target contract that doesn't implement EIP-1271 as expected.The contracts that may be affected are those that use
SignatureCheckerto check the validity of a signature and handle invalid signatures in a way other than reverting. We believe this to be unlikely.Patches
The issue was patched in 4.7.1.
References
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552
For more information
If you have any questions or comments about this advisory, or need assistance deploying the fix, email us at [email protected].
CVE-2022-35915
Impact
The target contract of an EIP-165
supportsInterfacequery can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost.Patches
The issue has been fixed in v4.7.2.
References
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3587
For more information
If you have any questions or comments about this advisory, or need assistance deploying a fix, email us at [email protected].
CVE-2022-35916
Impact
Contracts using the cross chain utilies for Arbitrum L2,
CrossChainEnabledArbitrumL2orLibArbitrumL2, will classify direct interactions of externally owned accounts (EOAs) as cross chain calls, even though they are not started on L1. This is assessed as low severity because any action taken by an EOA on the contract could also be taken by the EOA through the bridge if the issue was not present.Patches
This issue has been patched in v4.7.2.
References
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3578
For more information
If you have any questions or comments about this advisory, or need assistance deploying a fix, email us at [email protected].
CVE-2022-31198
Impact
This issue concerns instances of Governor that use the module
GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a proposal is passed to lower the quorum requirement, past proposals may become executable if they had been defeated only due to lack of quorum, and the number of votes it received meets the new quorum requirement.Analysis of instances on chain found only one proposal that met this condition, and we are actively monitoring for new occurrences of this particular issue.
Patches
This issue has been patched in v4.7.2.
Workarounds
Avoid lowering quorum requirements if a past proposal was defeated for lack of quorum.
References
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3561
For more information
If you have any questions or comments about this advisory, or need assistance deploying the fix, email us at [email protected].
CVE-2022-35961
Impact
The functions
ECDSA.recoverandECDSA.tryRecoverare vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issue for the functions that take a singlebytesargument, and not the functions that taker, v, sorr, vsas separate arguments.The potentially affected contracts are those that implement signature reuse or replay protection by marking the signature itself as used rather than the signed message or a nonce included in it. A user may take a signature that has already been submitted, submit it again in a different form, and bypass this protection.
Patches
The issue has been patched in 4.7.3.
For more information
If you have any questions or comments about this advisory, or need assistance deploying a fix, email us at [email protected].
CVE-2023-30541
Impact
A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding, the proxy could revert while attempting to decode the arguments from calldata.
The probability of an accidental clash is negligible, but one could be caused deliberately.
Patches
The issue has been fixed in v4.8.3.
Workarounds
If a function appears to be inaccessible for this reason, it may be possible to craft the calldata such that ABI decoding does not fail at the proxy and the function is properly proxied through.
References
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4154
CVE-2023-30542
Impact
The proposal creation entrypoint (
propose) inGovernorCompatibilityBravoallows the creation of proposals with asignaturesarray shorter than thecalldatasarray. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. TheProposalCreatedevent correctly represents what will eventually execute, but the proposal parameters as queried throughgetActionsappear to respect the original intended calldata.Patches
This issue has been patched in v4.8.3.
Workarounds
Ensure that all proposals that pass through governance have equal length
signaturesandcalldatasparameters.CVE-2023-34234
Impact
By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all.
This impacts the
Governorcontract in v4.9.0 only, and theGovernorCompatibilityBravocontract since v4.3.0.Patches
The problem has been patched in 4.9.1 by introducing opt-in frontrunning protection.
Workarounds
Submit the proposal creation transaction to an endpoint with frontrunning protection.
Credit
Reported by Lior Abadi and Joaquin Pereyra from Coinspect.
References
https://www.coinspect.com/openzeppelin-governor-dos/
CVE-2023-40014
Impact
OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using
ERC2771Contextalong with a custom trusted forwarder may see_msgSenderreturnaddress(0)in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case forMinimalForwarderfrom OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders.Patches
The problem has been patched in v4.9.3.
Release Notes
OpenZeppelin/openzeppelin-contracts-upgradeable (@openzeppelin/contracts-upgradeable)
v4.9.5Compare Source
Multicall: Patch duplicatedAddress.functionDelegateCall.v4.9.4Compare Source
ERC2771ContextandContext: Introduce a_contextPrefixLength()getter, used to trim extra information appended tomsg.data.Multicall: Make aware of non-canonical context (i.e.msg.senderis not_msgSender()), allowing compatibility withERC2771Context.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.