~ / search / GHSA-7grf-83vw-6f5x

GHSA-7grf-83vw-6f5x

OpenZeppelin Contracts ERC165Checker unbounded gas consumption

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-35915

Packages

EcosystemPackageAffectedFixed in
npm @openzeppelin/contracts >= 2.0.0, < 4.7.2 4.7.2
npm openzeppelin-solidity >= 2.0.0, <= 4.6.0 no fix listed
npm @openzeppelin/contracts-upgradeable >= 3.2.0, < 4.7.2 4.7.2
npm openzeppelin-eth >= 2.0.0, <= 2.2.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. ### Patches The issue has been fixed in v4.7.2. ### References https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3587 ### For more information If you have any questions or comments about this advisory, or need assistance deploying a fix, email us at [[email protected]](mailto:[email protected]).

References

External links from the advisory. They lead to third-party sites.