CVE-2022-35915 : What You Need to Know

OpenZeppelin Contracts library, versions >=2.0.0 and < 4.7.2, is affected by an unbounded gas consumption vulnerability. The issue has been assigned a CVSS base score of 5.3.

Understanding CVE-2022-35915

This vulnerability in OpenZeppelin Contracts library can lead to unbounded gas consumption, impacting smart contract development.

What is CVE-2022-35915?

OpenZeppelin Contracts library is prone to unbounded gas consumption due to potential excess data returned during an EIP-165

supportsInterface

query.

The Impact of CVE-2022-35915

The vulnerability can cause unbounded gas consumption, contrary to the generally assumed bounded cost of the operation. This issue has been addressed in version 4.7.2 of the library.

Technical Details of CVE-2022-35915

The technical details of this CVE include the vulnerability description, affected systems and versions, and exploitation mechanism.

Vulnerability Description

The vulnerability in OpenZeppelin Contracts library allows unbounded gas consumption, affecting secure smart contract development.

Affected Systems and Versions

Versions >=2.0.0 < 4.7.2 of the OpenZeppelin Contracts library are vulnerable to unbounded gas consumption.

Exploitation Mechanism

By triggering the target contract of an EIP-165

supportsInterface

query, an attacker could exploit this vulnerability to cause excessive gas usage.

Mitigation and Prevention

To mitigate the risk associated with CVE-2022-35915, users are advised to take immediate steps, adopt long-term security practices, and apply necessary patches and updates.

Immediate Steps to Take

Users should upgrade to version 4.7.2 of the OpenZeppelin Contracts library to address the unbounded gas consumption vulnerability.

Long-Term Security Practices

It is recommended to regularly update software libraries, follow secure coding practices, and conduct thorough code reviews to prevent similar vulnerabilities.

Patching and Updates

Ensure that all systems using the affected versions of the OpenZeppelin Contracts library are patched with the latest version (v4.7.2) to prevent exploitation of this vulnerability.