-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @openzeppelin/contracts | npm | >= 4.1.0, < 4.7.3 | 4.7.3 |
| @openzeppelin/contracts-upgradeable | npm | >= 4.1.0, < 4.7.3 | 4.7.3 |
Miggo AIRoot Cause AnalysisThe vulnerability documentation explicitly identifies these two functions as accepting both traditional 65-byte signatures and EIP-2098 compact 64-byte signatures. The commit diff shows removal of code handling 64-byte signatures in tryRecover(bytes32,bytes), and CHANGELOG notes these specific functions were modified to prevent compact signature acceptance. Tests were updated to reject compact signatures, confirming the attack vector was through these function variants.