-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @openzeppelin/contracts | npm | = 4.9.4 | 4.9.5 |
| @openzeppelin/contracts-upgradeable | npm | = 4.9.4 | 4.9.5 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from a duplicated 'functionDelegateCall' line in the multicall loop implementation, as shown in both the contracts and contracts-upgradeable commit diffs. The advisory explicitly states this caused double execution of subcalls. Both Multicall and MulticallUpgradeable versions in 4.9.4 contained this flawed loop structure, which was corrected by removing the duplicate line in 4.9.5. The functions' names and file paths are directly referenced in the diff and advisory context.
KEV Misses 88% of Exploited CVEs- Get the report