CVE Feed

    Dashboard / CVE / CVE-2022-31153

    CVE-2022-31153

    OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts (vanilla and ethereum flavors) in the v0.2.0 release of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet. Only goerli deployments of v0.2.0 accounts are affected. This faulty behavior is not observed in StarkNet's testing framework. This bug has been patched in v0.2.1.

    Published:Jul 15, 2022
    Last Modified:Apr 22, 2025
    EPS:Jul 15, 2022
    EPSS Score:0.00903
    CVSS Score:6.5

    Affected Products

    Vendor
    Openzeppelin
    Product
    Contracts

    Exploits

    https://github.com/OpenZeppelin/cairo-contracts/blob/release-0.2.0/src/openzeppelin/account/library.cairo#L203https://github.com/OpenZeppelin/cairo-contracts/issues/386https://github.com/OpenZeppelin/cairo-contracts/blob/release-0.2.0/src/openzeppelin/account/library.cairo#L203https://github.com/OpenZeppelin/cairo-contracts/issues/386

    Related CVEs

    CVE-2024-45304 (CVSS 5.3) — Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup. This vuln…
    CVE-2024-27094 (CVSS 6.5) — OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encode…
    CVE-2023-49798 (CVSS 5.9) — OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch…
    CVE-2023-34459 (CVSS 5.3) — OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to ver…
    CVE-2023-34234 (CVSS 5.3) — OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposa…
    CVE-2023-30541 (CVSS 5.3) — OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation co…
    CVE-2023-30542 (CVSS 6.8) — OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`…
    CVE-2023-26488 (CVSS 6.5) — OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract desi…
    CVE-2023-23940 (CVSS 6.4) — OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for Stark…
    CVE-2022-39384 (CVSS 5.6) — OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.…

    References

    https://github.com/OpenZeppelin/cairo-contracts/blob/release-0.2.0/src/openzeppelin/account/library.cairo#L203
    https://github.com/OpenZeppelin/cairo-contracts/commit/2cd60279c3332285d47edf9ee3888b71257acdc9
    https://github.com/OpenZeppelin/cairo-contracts/issues/386
    https://github.com/OpenZeppelin/cairo-contracts/pull/387
    https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.1
    https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-8mjr-jr5h-q2xr
    https://github.com/OpenZeppelin/cairo-contracts/blob/release-0.2.0/src/openzeppelin/account/library.cairo#L203
    https://github.com/OpenZeppelin/cairo-contracts/commit/2cd60279c3332285d47edf9ee3888b71257acdc9
    https://github.com/OpenZeppelin/cairo-contracts/issues/386
    https://github.com/OpenZeppelin/cairo-contracts/pull/387
    https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.1
    https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-8mjr-jr5h-q2xr

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High