CVE-2022-31153— OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-31153
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli
Source: NVD (National Vulnerability Database)
Vulnerability Description
OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts (vanilla and ethereum flavors) in the v0.2.0 release of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet. Only goerli deployments of v0.2.0 accounts are affected. This faulty behavior is not observed in StarkNet's testing framework. This bug has been patched in v0.2.1.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
在生命周期中对资源的控制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
OpenZeppelin 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenZeppelin是一个应用软件。一个安全区块链应用的标准。 OpenZeppelin Contracts for Cairo 0.2.0版本存在安全漏洞，该漏洞源于OpenZeppelin Contracts for Cairo 0.2.0版本存在一个错误，导致账户合约在实时网络上无法使用。这个问题影响了OpenZeppelin Contracts for Cairo v0.2.0版本中的所有账户（vanilla和ethereum flavors），这些账户不在StarkNet主网的白名单中。只有
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OpenZeppelin | cairo-contracts | = 0.2.0 | - |
II. Public POCs for CVE-2022-31153
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-31153
请登录查看更多情报信息。
- https://github.com/OpenZeppelin/cairo-contracts/pull/387x_refsource_MISC
- https://github.com/OpenZeppelin/cairo-contracts/issues/386x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2022-31153
IV. Related Vulnerabilities
Same vendor: OpenZeppelin
- CVE-2025-54070
OpenZeppelin Contracts's Bytes's lastIndexOf function with p - CVE-2024-45304
OwnableTwoStep allows a pending owner to accept ownership af - CVE-2024-27094
OpenZeppelin Contracts base64 encoding may read from potenti - CVE-2023-49798
Duplicated execution of subcalls in OpenZeppelin Contracts - CVE-2023-40014
OpenZeppelin Contracts's ERC2771Context with custom forwarde
V. Comments for CVE-2022-31153
No comments yet