Description

OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossChainEnabledArbitrumL2` or `LibArbitrumL2`, will classify direct interactions of externally owned accounts (EOAs) as cross chain calls, even though they are not started on L1. This issue has been patched in v4.7.2. Users are advised to upgrade. There are no known workarounds for this issue.

Remediation

References

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3578

https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9j3m-g383-29qr

Related Vulnerabilities

CVE-2023-5571 Vulnerability in npm package @vrite/sdk

CVE-2010-2273 Vulnerability in npm package dojo

CVE-2022-21803 Vulnerability in npm package nconf

CVE-2020-28461 Vulnerability in npm package js-ini

CVE-2018-1257 Vulnerability in maven package org.springframework:spring-messaging

Severity

Medium

Classification

CWE-669 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Patch Third Party Advisory