OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass
Résumé
OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. is_valid_eth_signature is missing a call to finalize_keccak after calling verify_eth_signature. As a result, any contract using is_valid_eth_signature from the account library (such as the EthAccount preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com