CVE-2022-31170
📋 TL;DR
OpenZeppelin Contracts library versions 4.0.0 through 4.7.0 have a vulnerability where ERC165Checker.supportsInterface() may revert instead of returning false when checking contracts that don't properly implement EIP-165. This affects smart contracts that use ERC165Checker to check interface support and handle non-support gracefully rather than reverting.
💻 Affected Systems
- OpenZeppelin Contracts
📦 What is this software?
Contracts by Openzeppelin
⚠️ Risk & Real-World Impact
Worst Case
Smart contracts relying on ERC165Checker for critical logic could experience unexpected reverts, potentially causing denial of service, failed transactions, or disruption of contract functionality.
Likely Case
Transactions involving affected contracts may fail when interacting with non-compliant EIP-165 contracts, causing inconvenience and potential financial loss from failed operations.
If Mitigated
If contracts handle reverts appropriately or only interact with properly implemented contracts, impact is minimal to none.
🎯 Exploit Status
Exploitation requires interacting with a vulnerable contract and a target contract that doesn't properly implement EIP-165.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.7.1
Vendor Advisory: https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-qh9x-gcfh-pcrw
Restart Required: No
Instructions:
1. Update OpenZeppelin Contracts dependency to version 4.7.1 or later. 2. Recompile and redeploy affected smart contracts. 3. Test contract functionality after update.
🔧 Temporary Workarounds
Avoid ERC165Checker for critical operations
allModify contracts to avoid using ERC165Checker.supportsInterface() for critical logic or implement additional error handling.
🧯 If You Can't Patch
- Implement additional error handling in contracts to catch potential reverts from ERC165Checker calls.
- Audit and restrict interactions to contracts known to properly implement EIP-165.
🔍 How to Verify
Check if Vulnerable:
Check if your contract uses OpenZeppelin Contracts version 4.0.0-4.7.0 and calls ERC165Checker.supportsInterface().Check Version:
Check package.json (npm) or .toml files for OpenZeppelin version.Verify Fix Applied:
Verify OpenZeppelin Contracts version is 4.7.1 or later and test contract interactions with non-compliant EIP-165 contracts.📡 Detection & Monitoring
Log Indicators:
- Unexpected transaction reverts when checking interface support
- Failed contract interactions involving ERC165Checker
Network Indicators:
- Increased failed transactions from affected contracts
SIEM Query:
Not applicable for smart contract vulnerabilities🔗 References
- https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-qh9x-gcfh-pcrw
- https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552
- https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-qh9x-gcfh-pcrw
