GHSA-29h2-jr22-frmh: OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet
Two locations consume an encrypted handle returned by an untrusted external party and use it without verifying that the party is ACL-authorized on it.
References
- github.com/OpenZeppelin/openzeppelin-confidential-contracts/commit/93e75ceed2b9648f53f9d133f431064353456805
- github.com/OpenZeppelin/openzeppelin-confidential-contracts/commit/ee47edf189ab681cebdad18bfb53dee541987be2
- github.com/OpenZeppelin/openzeppelin-confidential-contracts/commit/fe0863af2c9dce7614acce98720a913bf6a767a5
- github.com/OpenZeppelin/openzeppelin-confidential-contracts/pull/423
- github.com/OpenZeppelin/openzeppelin-confidential-contracts/pull/428
- github.com/OpenZeppelin/openzeppelin-confidential-contracts/pull/431
- github.com/OpenZeppelin/openzeppelin-confidential-contracts/releases/tag/v0.3.2
- github.com/OpenZeppelin/openzeppelin-confidential-contracts/releases/tag/v0.4.2
- github.com/OpenZeppelin/openzeppelin-confidential-contracts/releases/tag/v0.5.2
- github.com/OpenZeppelin/openzeppelin-confidential-contracts/security/advisories/GHSA-29h2-jr22-frmh
- github.com/advisories/GHSA-29h2-jr22-frmh
Code Behaviors & Features
Detect and mitigate GHSA-29h2-jr22-frmh with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →