CVE-2022-31170

    Dashboard / Vulnerabilities / CVE-2022-31170

    CVE-2022-31170

    Published: 21 Jul 2022Last Modified: 12 Aug 2026

    Summary: OpenZeppelin Contracts's ERC165Checker may revert instead of returning false

    Details: OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning `false`. `ERC165Checker.supportsInterface` is designed to always successfully return a boolean, and under no circumstance revert. However, an incorrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't implement EIP-165 as expected, specifically if it returns a value other than 0 or 1. The contracts that may be affected are those that use `ERC165Checker` to check for support for an interface and then handle the lack of support in a way other than reverting. The issue was patched in version 4.7.1.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31170.json, https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-qh9x-gcfh-pcrw, https://nvd.nist.gov/vuln/detail/CVE-2022-31170, https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- a673994de5eba4305cefb8ae98ea9ad37a43efaa
    Fixed -3b8b4ba82c880c31cd3b96dd5e15741d7e26658e

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31170 | CVE-DB