Executive Summary
A vulnerability in OpenZeppelin's Confidential Contracts, specifically in the `VestingWalletConfidential` component, allows a malicious ERC-7984 token to extract private data from the vesting wallet. The vulnerability has a CVSS score of 7.1 and has been patched in versions v0.5.2, v0.4.2, and v0.3.2.
Technical Analysis
The vulnerability is caused by the `VestingWalletConfidential` component consuming an encrypted handle returned by an untrusted external party and using it without verifying that the party is ACL-authorized on it. A malicious user can call `release` with a malicious token, which can return an alternative handle on `confidentialBalanceOf`, representing the balance of the vesting wallet on an alternative ERC-7984 token. The vesting wallet does not check that the token has ACL access and grants access to a new handle derived from the returned handle.
How It Gets Exploited
An attacker can exploit this vulnerability by creating a malicious ERC-7984 token that returns an alternative handle on `confidentialBalanceOf`. The attacker can then call `release` with the malicious token, allowing them to gain information about any private `euint64` handle that the vesting wallet has access to. The attack does not result in a loss of funds but can lead to private data exposure.
Impact Assessment
The vulnerability affects users of OpenZeppelin's Confidential Contracts, specifically those using versions prior to v0.5.2, v0.4.2, and v0.3.2. An attacker can achieve private data exposure, but there is no loss of funds. The CVSS score of 7.1 indicates a high severity level.
Recommended Actions
To mitigate this vulnerability, users should update to a patched version of OpenZeppelin's Confidential Contracts (v0.5.2, v0.4.2, or v0.3.2). Additionally, users should ensure that they are using a trusted and authorized ERC-7984 token to prevent exploitation.
Sources
- GitHub Security Advisories: GHSA-29h2-jr22-frmh