CVE-2023-40014
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
In the OpenZeppelin Contracts library, versions from 4.0.0 to 4.9.2 have an issue where the `_msgSender` method may return `address(0)` for calls originating from a trusted forwarder with calldata shorter than 20 bytes. This issue has been patched in version 4.9.3.
Risk Assessment
Organizations using affected versions may be at risk of incorrectly identifying the sender of transactions, potentially leading to unauthorized access or manipulation of contracts.
Recommendation
It is recommended to update the OpenZeppelin Contracts library to version 4.9.3 or later to mitigate this vulnerability.
Original NVD description (English source)
OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.