Which function in OpenZeppelin/openzeppelin-contracts has been patched by the most CVEs?

supportsInterface in contracts/mocks/ERC165/ERC165MaliciousData.sol has been changed by 2 CVE fixes, from 2022 to 2022.

How large is a typical CVE fix in OpenZeppelin/openzeppelin-contracts?

The median fix changes 27 lines. 39% of fixes change 20 lines or fewer, and 17% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

solidity

#303 of 500 repositories

OpenZeppelin/openzeppelin-contracts

Name: OpenZeppelin/openzeppelin-contracts: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix February 29, 2024

18

CVE fixes located

Published CVEs

41

Functions patched

Distinct function sites

28

Files patched

Distinct source files

2021–2024

Years covered

By CVE publication date

Overview

18 published CVEs have a fix traced to functions in OpenZeppelin/openzeppelin-contracts, the earliest published in 2021. Those fixes changed 41 distinct functions across 28 files, in 100 patch hunks.

Among the 500 repositories tracked here, OpenZeppelin/openzeppelin-contracts ranks #303 by the number of CVEs with a located fix.

Most patched functions

Functions in OpenZeppelin/openzeppelin-contracts changed by the most CVE fixes.

Most patched files

Files in OpenZeppelin/openzeppelin-contracts changed by the most CVE fixes.

1contracts/utils/introspection/ERC165Checker.sol3 CVEs · 1 functions
2contracts/governance/TimelockController.sol2 CVEs · 1 functions
3contracts/mocks/ERC1271WalletMock.sol2 CVEs · 1 functions
4contracts/mocks/ERC165/ERC165MaliciousData.sol2 CVEs · 1 functions
5contracts/utils/cryptography/SignatureChecker.sol2 CVEs · 0 functions
6contracts/mocks/MultipleInheritanceInitializableMocks.sol1 CVEs · 5 functions
7contracts/proxy/transparent/ProxyAdmin.sol1 CVEs · 5 functions
8contracts/proxy/transparent/TransparentUpgradeableProxy.sol1 CVEs · 4 functions
9contracts/proxy/utils/UUPSUpgradeable.sol1 CVEs · 3 functions
10contracts/crosschain/arbitrum/LibArbitrumL2.sol1 CVEs · 2 functions

Fix size

How much code a CVE fix in OpenZeppelin/openzeppelin-contracts changes, with backports counted once.

27

Median lines changed

Added plus removed, per CVE

39%

Fixes of 20 lines or fewer

Share of CVE fixes

17%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in OpenZeppelin/openzeppelin-contracts, and the functions each fix changed.

OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
CVE-2024-27094A
High · CVSS 7.4
EPSS 0.8%2024-02-29
OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4
CVE-2023-49798
High · CVSS 7.5
EPSS 0.5%2023-12-08
OpenZeppelin Contracts vulnerable to Improper Escaping of Output
CVE-2023-40014msgDataShort _msgData _msgSender
Medium · CVSS 5.3
EPSS 0.7%2023-08-10
OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees
CVE-2023-34459
Medium · CVSS 5.9
EPSS 0.4%2023-06-16
OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning
CVE-2023-34234_isValidDescriptionForProposer propose
Medium · CVSS 5.3
EPSS 0.6%2023-06-07
OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated
CVE-2023-30541_fallback IERC1967 ITransparentUpgradeableProxy
Medium · CVSS 5.3
EPSS 0.8%2023-04-17
GovernorCompatibilityBravo may trim proposal calldata
CVE-2023-30542
High · CVSS 8.8
EPSS 0.6%2023-04-16
OpenZeppelin Contracts contains Incorrect Calculation
CVE-2023-26488_beforeTokenTransfer __unsafe_increaseBalance
Medium · CVSS 6.5
EPSS 0.7%2023-03-03
OpenZeppelin Contracts initializer reentrancy may lead to double initialization
CVE-2022-39384__SampleChild_init initialize onlyInitializing
Medium · CVSS 5.6
EPSS 0.6%2022-11-04
OpenZeppelin Contracts vulnerable to ECDSA signature malleability
CVE-2022-35961tryRecover
High · CVSS 7.9
EPSS 0.4%2022-08-14
OpenZeppelin Contracts ERC165Checker unbounded gas consumption
CVE-2022-35915supportsInterface supportsERC165InterfaceUnchecked
Medium · CVSS 5.3
EPSS 0.8%2022-08-01
Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls
CVE-2022-35916isTopLevelCall crossChainSender isCrossChain
Medium · CVSS 5.3
EPSS 0.6%2022-08-01

Get an alert for each new OpenZeppelin/openzeppelin-contracts CVE, with the patched functions and AI-written analysis.

Monitor openzeppelin-contracts CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

apache/roller18 CVEs chatwoot/chatwoot18 CVEs containerd/containerd18 CVEs debian/ntfs-3g18 CVEs decidim/decidim18 CVEs dompdf/dompdf18 CVEs facebook/hermes18 CVEs frangoteam/FUXA18 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in OpenZeppelin/openzeppelin-contracts.

How many CVEs have a located fix in OpenZeppelin/openzeppelin-contracts?: 18 published CVEs have a fix traced to functions in OpenZeppelin/openzeppelin-contracts, touching 41 functions across 28 files.
Which function in OpenZeppelin/openzeppelin-contracts has been patched by the most CVEs?: supportsInterface in contracts/mocks/ERC165/ERC165MaliciousData.sol has been changed by 2 CVE fixes, from 2022 to 2022.
How large is a typical CVE fix in OpenZeppelin/openzeppelin-contracts?: The median fix changes 27 lines. 39% of fixes change 20 lines or fewer, and 17% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track OpenZeppelin/openzeppelin-contracts CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing