CVE-2023-40014 Information

Description

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3 contracts using ERC2771Context along with a custom trusted forwarder may see _msgSender return address(0) in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common in particular it is not the case for MinimalForwarder from OpenZeppelin Contracts or any deployed forwarder the team is aware of given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.

Reference

https://github.com/OpenZeppelin/openzeppelin-contracts/commit/9445f96223041abf2bf08daa56f8da50b674cbcd https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4484 https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.9.3 https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4481 https://github.com/OpenZeppelin/openzeppelin-contracts/commit/e4435eed757d4309436b1e06608e97b6d6e2fdb5 https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-g4vp-m682-qqmp