Vulnerability Details CVE-2023-23940
OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 0.4%
CVSS Severity
CVSS v3 Score 6.4
References
- https://github.com/OpenZeppelin/cairo-contracts/pull/542/commits/6d4cb750478fca2fd916f73297632f899aca9299
- https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-626q-v9j4-mcp4
- https://github.com/OpenZeppelin/cairo-contracts/pull/542/commits/6d4cb750478fca2fd916f73297632f899aca9299
- https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-626q-v9j4-mcp4
Products affected by CVE-2023-23940
-
cpe:2.3:a:openzeppelin:contracts:0.2.0
-
cpe:2.3:a:openzeppelin:contracts:0.3.0
-
cpe:2.3:a:openzeppelin:contracts:0.3.1
-
cpe:2.3:a:openzeppelin:contracts:0.3.2
-
cpe:2.3:a:openzeppelin:contracts:0.4.0
-
cpe:2.3:a:openzeppelin:contracts:0.5.0
-
cpe:2.3:a:openzeppelin:contracts:0.5.1
-
cpe:2.3:a:openzeppelin:contracts:0.6.0