Skip to content
OpenAdvisories
Medium · 6.4 CVE-2023-23940 EUVD-2023-0188GHSA-626q-v9j4-mcp4PYSEC-2023-39

OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass

Published Feb 3, 2023 · Updated Mar 10, 2025 · Assigned by GitHub_M

Description

OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.

Affected products

VendorProductAffectedFixed
OpenZeppelin cairo-contracts >= 0.2.0, < 0.6.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI openzeppelin-cairo-contracts >= 0.2.0, < 0.6.1 0.6.1 GHSA-626q-v9j4-mcp4

References