CVE-2023-23940CWE-345CWE-347

OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass

Medium · published February 3, 2023

CVSS v3.1
6.4
EPSS
0%
Percentile
11.9
In the wild
Unconfirmed
What it is

OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00220 · 11.9th percentile
Weaknesses
CWE-345 · Insufficient Verification of Data Authenticity; CWE-347 · Improper Verification of Cryptographic Signature
Published
2023-02-03T19:43Z
EPSS history
Timeline
  • 03 FEB 19:43Z
    OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass
    cvelistv5