CVE-2022-31172 - CVE House

Back to Database

Status published High CVE-2022-31172

OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers

7.5 CVSS

Vulnerability Description

OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. `SignatureChecker.isValidSignatureNow` is not expected to revert. However, an incorrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't implement EIP-1271 as expected. The contracts that may be affected are those that use `SignatureChecker` to check the validity of a signature and handle invalid signatures in a way other than reverting. The issue was patched in version 4.7.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-31172

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenZeppelin

View All →

OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers

OwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contracts

OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

Duplicated execution of subcalls in OpenZeppelin Contracts

OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender

Affected Vendor

OpenZeppelin

View all reports →

Affected Software

openzeppelin-contracts

Vulnerable Versions:

>= 4.1.0, < 4.7.1

Timeline

Official Publish: July 21st, 2022

Last Modified: April 23rd, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation