fix(deps): update dependency @openzeppelin/contracts to v4.9.5 [security] #3184
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
…ity] | datasource | package | from | to | | ---------- | ----------------------- | ----- | ----- | | npm | @openzeppelin/contracts | 4.9.3 | 4.9.5 | Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
github-actions
bot
added
M-contracts
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #3184 +/- ##
===================================================
- Coverage 41.54443% 41.10511% -0.43932%
===================================================
Files 460 454 -6
Lines 25770 25554 -216
Branches 357 293 -64
===================================================
- Hits 10706 10504 -202
+ Misses 14326 14312 -14
Partials 738 738
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Deploying sanguine-fe with
|
| Latest commit: |
846deed
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://4874679c.sanguine-fe.pages.dev |
| Branch Preview URL: | https://renovate-contracts-core-npm.sanguine-fe.pages.dev |
|
Closing as not relevant |
github-actions
bot
deleted the
renovate/contracts-core-npm-openzeppelin-contracts-vulnerability
branch
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update ( If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
This PR contains the following updates:
4.9.3->4.9.5Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2023-30541
Impact
A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding, the proxy could revert while attempting to decode the arguments from calldata.
The probability of an accidental clash is negligible, but one could be caused deliberately.
Patches
The issue has been fixed in v4.8.3.
Workarounds
If a function appears to be inaccessible for this reason, it may be possible to craft the calldata such that ABI decoding does not fail at the proxy and the function is properly proxied through.
References
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4154
CVE-2023-30542
Impact
The proposal creation entrypoint (
propose) inGovernorCompatibilityBravoallows the creation of proposals with asignaturesarray shorter than thecalldatasarray. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. TheProposalCreatedevent correctly represents what will eventually execute, but the proposal parameters as queried throughgetActionsappear to respect the original intended calldata.Patches
This issue has been patched in v4.8.3.
Workarounds
Ensure that all proposals that pass through governance have equal length
signaturesandcalldatasparameters.CVE-2023-34234
Impact
By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all.
This impacts the
Governorcontract in v4.9.0 only, and theGovernorCompatibilityBravocontract since v4.3.0.Patches
The problem has been patched in 4.9.1 by introducing opt-in frontrunning protection.
Workarounds
Submit the proposal creation transaction to an endpoint with frontrunning protection.
Credit
Reported by Lior Abadi and Joaquin Pereyra from Coinspect.
References
https://www.coinspect.com/openzeppelin-governor-dos/
CVE-2023-34459
Impact
When the
verifyMultiProof,verifyMultiProofCalldata,processMultiProof, orprocessMultiProofCalldatafunctions are in use, it is possible to construct merkle trees that allow forging a valid multiproof for an arbitrary set of leaves.A contract may be vulnerable if it uses multiproofs for verification and the merkle tree that is processed includes a node with value 0 at depth 1 (just under the root). This could happen inadvertently for balanced trees with 3 leaves or less, if the leaves are not hashed. This could happen deliberately if a malicious tree builder includes such a node in the tree.
A contract is not vulnerable if it uses single-leaf proving (
verify,verifyCalldata,processProof, orprocessProofCalldata), or if it uses multiproofs with a known tree that has hashed leaves. Standard merkle trees produced or validated with the @openzeppelin/merkle-tree library are safe.Patches
The problem has been patched in 4.9.2.
Workarounds
If you are using multiproofs: When constructing merkle trees hash the leaves and do not insert empty nodes in your trees. Using the @openzeppelin/merkle-tree package eliminates this issue. Do not accept user-provided merkle roots without reconstructing at least the first level of the tree. Verify the merkle tree structure by reconstructing it from the leaves.
CVE-2023-40014
Impact
OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using
ERC2771Contextalong with a custom trusted forwarder may see_msgSenderreturnaddress(0)in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case forMinimalForwarderfrom OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders.Patches
The problem has been patched in v4.9.3.
Release Notes
OpenZeppelin/openzeppelin-contracts (@openzeppelin/contracts)
v4.9.5Compare Source
Multicall: Make aware of non-canonical context (i.e.msg.senderis not_msgSender()), allowing compatibility withERC2771Context. Patch duplicatedAddress.functionDelegateCallin v4.9.4 (removed).v4.9.4Compare Source
ERC2771ContextandContext: Introduce a_contextPrefixLength()getter, used to trim extra information appended tomsg.data.Multicall: Make aware of non-canonical context (i.e.msg.senderis not_msgSender()), allowing compatibility withERC2771Context.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.