First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

OpenZeppelin contracts old version

kiteweb3

Summary

Using old versions of 3rd-party libraries in the build process can introduce vulnerabilities to the protocol code.

Vulnerability Details

In lib/openzeppelin-contracts/package.json:

"name": "openzeppelin-solidity",
"description": "Secure Smart Contract library for Solidity",
@> "version": "3.4.0",
"files": [
"/contracts/**/*.sol",
"/build/contracts/*.json",
"!/contracts/mocks",
"/test/behaviors"
],
...

Impact

  • Older versions of OpenZeppelin contracts might not have fixes for known security vulnerabilities.

  • Older versions might contain features or functionality that have been deprecated in recent versions.

  • Newer versions often come with new features, optimizations, and improvements that are not available in older versions.

Tools Used

Manual review

Recommendations

Review the latest stable version of the OpenZeppelin contracts (https://github.com/OpenZeppelin/openzeppelin-contracts/releases) and upgrade.

Updates

Lead Judging Commences

patrickalphac Lead Judge about 2 years ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!