TI-2023-27205 Aliases CVE-2023-49798 GHSA-699g-q6qh-q4v8

Duplicated execution of subcalls in OpenZeppelin Contracts

LOW 34CWE-670Published 2023-12-08 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In the version of `Multicall.sol` released in `@openzeppelin/[email protected]` and `@openzeppelin/[email protected]`, all subcalls are executed twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers. The duplicated delegatecall was removed in version 4.9.5. The 4.9.4 version is marked as deprecated. Users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

EPSS 0.00543 45th percentileScored 2026-11-07

Fix Fixed @openzeppelin/contracts (npm): 4.9.5@openzeppelin/contracts-upgradeable (npm): 4.9.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenZeppelin	openzeppelin-contracts	= 4.9.4	—	No fix listed	CNA
—	@openzeppelin/contracts (npm)	4.9.4 to before 4.9.5	4.9.5	Patch available	GHSA-699g-q6qh-q4v8
—	@openzeppelin/contracts-upgradeable (npm)	4.9.4 to before 4.9.5	4.9.5	Patch available	GHSA-699g-q6qh-q4v8

openzeppelin-contracts VendorOpenZeppelin Affected = 4.9.4 Fixed in — No fix listed CNA
@openzeppelin/contracts (npm) Vendor— Affected 4.9.4 to before 4.9.5 Fixed in 4.9.5 Patch available GHSA-699g-q6qh-q4v8
@openzeppelin/contracts-upgradeable (npm) Vendor— Affected 4.9.4 to before 4.9.5 Fixed in 4.9.5 Patch available GHSA-699g-q6qh-q4v8

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:openzeppelin:contracts:4.9.4:::::node.js::	4.9.4	Vulnerable	OpenZeppelin
cpe:2.3:a:openzeppelin:contracts_upgradeable:4.9.4:::::node.js::	4.9.4	Vulnerable	OpenZeppelin

cpe:2.3:a:openzeppelin:contracts:4.9.4:*:*:*:*:node.js:*:* Versions 4.9.4 Vulnerable ·OpenZeppelin
cpe:2.3:a:openzeppelin:contracts_upgradeable:4.9.4:*:*:*:*:node.js:*:* Versions 4.9.4 Vulnerable ·OpenZeppelin

Remediation

Fix · GHSA-699g-q6qh-q4v8 @openzeppelin/contracts (npm) Fixed in 4.9.5 Advisory →
Fix · GHSA-699g-q6qh-q4v8 @openzeppelin/contracts-upgradeable (npm) Fixed in 4.9.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-49798
2026-10-03 Alias added: GHSA-699g-q6qh-q4v8

References

Patch 1

https://github.com/OpenZeppelin/openzeppelin-contracts/commit/88ac712e06832bce73b41e8166cded2729e25205

Advisory 2

Other 2

TI-2022-13196 OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli CVSS 3.1MEDIUM 6.5
TI-2021-16554 TimelockController vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 10.0
TI-2021-16553 TimelockController vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 10.0
TI-2021-18096 UUPSUpgradeable vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 9.8
TI-2022-13238 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts CVSS 3.1HIGH 7.5
TI-2022-13212 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false CVSS 3.1HIGH 7.5

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences