Vulnerability Description
OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openzeppelin | Contracts | >= 0.2.0, < 0.6.1 |
Related Weaknesses (CWE)
References
- https://github.com/OpenZeppelin/cairo-contracts/pull/542/commits/6d4cb750478fca2PatchThird Party Advisory
- https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-626q-v9Third Party Advisory
- https://github.com/OpenZeppelin/cairo-contracts/pull/542/commits/6d4cb750478fca2PatchThird Party Advisory
- https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-626q-v9Third Party Advisory
FAQ
What is CVE-2023-23940?
CVE-2023-23940 is a vulnerability with a CVSS score of 6.4 (MEDIUM). OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_ke...
How severe is CVE-2023-23940?
CVE-2023-23940 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-23940?
Check the references section above for vendor advisories and patch information. Affected products include: Openzeppelin Contracts.