Addressing Vulnerabilities in Outdated OpenZeppelin v4.9.2 Implementation.
Summary
This report details the vulnerabilities discovered in a project that utilizes an outdated version of the OpenZeppelin library (v4.9.2).
The identified issues are critical to the security and functionality of the smart contracts within the project,
and updating to a more recent version is strongly recommended.
Vulnerability Details
The project relies on OpenZeppelin v4.9.2, which is known to have several vulnerabilities that could be exploited by malicious actors.
These vulnerabilities include:
This is the OpenZeppelin used: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/e50c24f5839db17f46991478384bfda14acfb830/package.json#L2-L4
Impact
Using outdated Openzeppelin can lead to open new vector attacks.
Recommendations
Upgrade OpenZeppelin Library: Update to the latest version of OpenZeppelin at least v5.0.2 or newer.
https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/package.json
Lead Judging Commences
Informational / Gas
Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.