PT-2026-71722 · Openzeppelin · Confidential Contracts
CVE-2026-73645
·
Published
2026-01-05
·
Updated
2026-08-13
CVSS v4.0
6.6
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
OpenZeppelin Confidential Contracts versions prior to 0.3.1
Description
In the ERC7984 contract, the confidential total supply is tracked using an
euint64 value. An overflowing internal mint() function can fail silently. The wrap() and onTransferReceived() functions in contracts/token/ERC7984/extensions/ERC7984ERC20Wrapper.sol do not handle this failure, allowing a user to transfer the underlying token without receiving the corresponding confidential wrapped token. Using the default rate(), the wrapper reaches capacity after approximately 18.4 trillion tokens, and subsequent wrapping requests may result in loss of funds.Recommendations
Update to version 0.3.1.
Exploit
Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Confidential Contracts