CVE Feed

    Dashboard / CVE / CVE-2024-45304

    CVE-2024-45304

    Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup. This vulnerability can lead to unauthorized ownership transfer, contrary to the original owner's intention of leaving the contract without an owner. It introduces a security risk where an unintended party (pending owner) can gain control of the contract after the original owner has renounced ownership. This could also be used by a malicious owner to simulate leaving a contract without an owner, to later regain ownership by previously having proposed himself as a pending owner. This issue has been addressed in release version 0.16.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published:Aug 30, 2024
    Last Modified:Sep 19, 2024
    EPS:Aug 30, 2024
    EPSS Score:0.00019
    CVSS Score:5.3

    Affected Products

    Vendor
    Openzeppelin
    Product
    Contracts

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-27094 (CVSS 6.5) — OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encode…
    CVE-2023-49798 (CVSS 5.9) — OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch…
    CVE-2023-34459 (CVSS 5.3) — OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to ver…
    CVE-2023-34234 (CVSS 5.3) — OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposa…
    CVE-2023-30541 (CVSS 5.3) — OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation co…
    CVE-2023-30542 (CVSS 6.8) — OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`…
    CVE-2023-26488 (CVSS 6.5) — OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract desi…
    CVE-2023-23940 (CVSS 6.4) — OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for Stark…
    CVE-2022-39384 (CVSS 5.6) — OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.…
    CVE-2022-35961 (CVSS 7.9) — OpenZeppelin Contracts is a library for secure smart contract development. The functions `ECDSA.recover` and `…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High