CVE-2023-23940
published 2023-02-03CVE-2023-23940: OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup…
PriorityP429medium5.3CVSS 3.1
AVNACHPRLUINSUCHINAN
EPSS
0.22%
12.5th percentile
OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openzeppelin | cairo-contracts | — | — |
| openzeppelin | contracts | >= 0.2.0 < 0.6.1 | 0.6.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-23940: OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup
osv·2023-02-03
CVE-2023-23940 CVE-2023-23940: OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup
OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.
GHSA
OpenZeppelin Contracts contains Improper Verification of Cryptographic Signature
ghsa·2023-02-02
CVE-2023-23940 [MEDIUM] CWE-345 OpenZeppelin Contracts contains Improper Verification of Cryptographic Signature
OpenZeppelin Contracts contains Improper Verification of Cryptographic Signature
### Cause
`is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`.
### Impact
As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts.
### Risk
In order to exploit this vulnerability, it is required to control a sequencer or prover since they're the ones executing the hints, being able to inject incorrect keccak results.
Today StarkWare is the only party running both a prover or a sequencer, greatly reducing the risk of exploit.
### Patc
OSV
OpenZeppelin Contracts contains Improper Verification of Cryptographic Signature
osv·2023-02-02
CVE-2023-23940 [MEDIUM] OpenZeppelin Contracts contains Improper Verification of Cryptographic Signature
OpenZeppelin Contracts contains Improper Verification of Cryptographic Signature
### Cause
`is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`.
### Impact
As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts.
### Risk
In order to exploit this vulnerability, it is required to control a sequencer or prover since they're the ones executing the hints, being able to inject incorrect keccak results.
Today StarkWare is the only party running both a prover or a sequencer, greatly reducing the risk of exploit.
### Patc
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/OpenZeppelin/cairo-contracts/pull/542/commits/6d4cb750478fca2fd916f73297632f899aca9299https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-626q-v9j4-mcp4https://github.com/OpenZeppelin/cairo-contracts/pull/542/commits/6d4cb750478fca2fd916f73297632f899aca9299https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-626q-v9j4-mcp4
2023-02-03
Published