CVE-2022-31172

    Dashboard / Vulnerabilities / CVE-2022-31172

    CVE-2022-31172

    Published: 21 Jul 2022Last Modified: 12 Aug 2026

    Summary: OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers

    Details: OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. `SignatureChecker.isValidSignatureNow` is not expected to revert. However, an incorrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't implement EIP-1271 as expected. The contracts that may be affected are those that use `SignatureChecker` to check the validity of a signature and handle invalid signatures in a way other than reverting. The issue was patched in version 4.7.1.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31172.json, https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-4g63-c64m-25w9, https://nvd.nist.gov/vuln/detail/CVE-2022-31172, https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 23869e5b2a7c6b9c3e27dee4289615b8cf50e36b
    Fixed -3b8b4ba82c880c31cd3b96dd5e15741d7e26658e

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31172 | CVE-DB