Integer overflow in openzeppelin-confidential-contracts
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0.3.1, the ERC7984 contract tracked confidential total supply with an euint64 value, and an overflowing internal _mint operation could fail silently. The wrap and onTransferReceived functions in contracts/token/ERC7984/extensions/ERC7984ERC20Wrapper.sol did not handle that failure, so a user could transfer the underlying token without receiving the corresponding confidential wrapped token. With the default rate(), the wrapper fills after approximately 18.4 trillion tokens, and subsequent wrapping requests can cause loss of funds. This issue is fixed in version 0.3.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenZeppelin | openzeppelin-confidential-contracts | before 0.3.1 | 0.3.1 | Patch available | CNA |
| — | @openzeppelin/confidential-contracts (npm) | before 0.3.1 | 0.3.1 | Patch available | GHSA-hqf9-8xv5-x8xw |
- openzeppelin-confidential-contracts VendorOpenZeppelin Affected before 0.3.1 Fixed in 0.3.1 Patch available CNA
- @openzeppelin/confidential-contracts (npm) Vendor— Affected before 0.3.1 Fixed in 0.3.1 Patch available GHSA-hqf9-8xv5-x8xw
Remediation
- Fix · CNA openzeppelin-confidential-contracts (OpenZeppelin) Fixed in 0.3.1
- Fix · GHSA-hqf9-8xv5-x8xw @openzeppelin/confidential-contracts (npm) Fixed in 0.3.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73645
- 2026-10-03 Alias added: GHSA-hqf9-8xv5-x8xw
References
Other 5
- https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/security/advisories/GHSA-hqf9-8xv5-x8xw
- https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/pull/271
- https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/commit/c620d4386021dde63ae3ea1507dee8543791134a
- https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/releases/tag/v0.3.1
- https://github.com/OpenZeppelin/openzeppelin-confidential-contracts
More OpenZeppelin vulnerabilities
- TI-2022-13196 OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli CVSS 3.1MEDIUM 6.5
- TI-2021-16554 TimelockController vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 10.0
- TI-2021-16553 TimelockController vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 10.0
- TI-2021-18096 UUPSUpgradeable vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 9.8
- TI-2026-35496 Code injection in OpenZeppelin contracts-wizard CVSS 3.1HIGH 8.8
- TI-2022-13238 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts CVSS 3.1HIGH 7.5
Sources
- CVE-2026-73645 · CVE Program
- CVE-2026-73645 · NVD
- FIRST EPSS
- GHSA-hqf9-8xv5-x8xw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences