Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-31170

CVE-2022-31170: OpenZeppelin Contracts's ERC165Checker may revert instead of returning false

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-31170
GHSA ID
GHSA-qh9x-gcfh-pcrw
EPSS Score
0.27924%
CWE
CWE-20
Published
7/21/2022
Updated
1/30/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
@openzeppelin/contractsnpm>= 4.0.0, < 4.7.14.7.1
@openzeppelin/contracts-upgradeablenpm>= 4.0.0, < 4.7.14.7.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from ERC165Checker's assumption that target contracts properly implement EIP-165. The core issue was in supportsERC165InterfaceUnchecked which performed an unsafe abi.decode on potentially malformed return data. The GitHub PR #3552 specifically modifies this function to check return data length and interpret any non-zero value as 'true', avoiding strict boolean decoding. While supportsInterface is the public facing function, the actual vulnerability was in the unchecked low-level implementation it depends on.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t `*R********k*r.supportsInt*r****` is **si*n** to *lw*ys su***ss*ully r*turn * *ool**n, *n* un**r no *ir*umst*n** r*v*rt. *ow*v*r, *n in*orr**t *ssumption **out Soli*ity *.*'s `**i.***o**` *llows som* **s*s to r*v*rt, *iv*n * t*r**t *ontr*

Reasoning

T** vuln*r**ility st*ms *rom `*R********k*r`'s *ssumption t**t t*r**t *ontr**ts prop*rly impl*m*nt `*IP-***`. T** *or* issu* w*s in `supports*R****Int*r****Un****k**` w*i** p*r*orm** *n uns*** `**i.***o**` on pot*nti*lly m*l*orm** r*turn **t*. T** *i