Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@openzeppelin/confidential-contracts

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1npmAmendedPublished

    OpenZeppelin Confidential Contracts VestingWalletConfidential: a malicious ERC-7984 token is able to extract private data from the vesting wallet

    GHSA-29h2-jr22-frmh

    Affected
    • npm @openzeppelin/confidential-contracts < 0.3.2; >= 0.4.0-rc.0, < 0.4.2; >= 0.5.0-rc.0, < 0.5.2
    Fixed in
    0.5.20.3.20.4.2· Vendor fix available
    Issue
    Impact Two locations consume an encrypted handle returned by an untrusted external party and use it without verifying that the party is ACL-authorized on it. VestingWalletConfidential Malicious users can call release with a malicious token. This token could return an alternative handle on confidentialBalanceOf, which represents the balance of the vesting wallet on an alternative ERC-7984 token (or any other handle that the vesting wallet has access to). The vesting wallet does not check that the token has ACL access and grants access to a new handle derived from the returned handle. Effectively, this bug allows a malicious user to gain information about any private euint64 handle that the vesting wallet has access to via a malicious ERC-7984 token. There is no loss of funds. ERC7984 On a transfer with callback, ERC7984 uses the ebool returned by the recipient's IERC7984Receiver.onConfidentialTransferReceived to drive the refund logic, without checking that the recipient has ACL…

    Recommended action: Upgrade to 0.5.2, 0.4.2 or 0.3.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →
  2. Medium, CVSS 6.6npmAmendedPublished

    ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.

    CVE-2026-73645 · GHSA-hqf9-8xv5-x8xw

    Affected
    • npm @openzeppelin/confidential-contracts <= 0.3.0
    Fixed in
    0.3.1· Vendor fix available
    Issue
    Impact The ERC7984 contract tracks total supply using a confidential euint64 value. If a call to the internal mint function would result in the total supply overflowing, the call fails silently. The wrap and onTransferReceived functions in ERC7984ERC20Wrapper assume that mint won't fail silently and do not check the return value. If the mint function fails silently, users do not receive the confidential wrapped token but still send the underlying token, resulting in a loss of funds. By default (without overriding rate(), the wrapper fills up after wrapping ~18.4 trillion tokens. There are very few tokens of value with sufficient total supply to result in the filling of the wrapper. That said, we recommend upgrading to 0.3.1 to remove this issue. Patches This issue has been patched in the 0.3.1 release.

    Recommended action: Upgrade to 0.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →