OpenZeppelin vulnerabilities
We track 7 vulnerabilities in OpenZeppelin products across 4 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on August 6, 2026.
Latest OpenZeppelin vulnerabilities
- 8.8 High severity
contracts-wizard: Improper Control of Generation of Code
OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts.name` (ERC20/ERC721)
- 7.4 High severity
openzeppelin-contracts: Out-of-bounds Read
OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory t
- 7.5 High severity
openzeppelin-contracts: Always-Incorrect Control Flow Implementation
OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In the version of `Multicall.sol` released in `@openzeppelin/[email protected]` and `@openzeppelin/contrac
- 8.8 High severity
OpenZeppelin Contracts is a library for secure smart contract development.
OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes t
- 7.5 High severity
openzeppelin-contracts: Incorrect Calculation
OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module `GovernorVotesQuorumFraction`, a mechanism that determines quorum requirements as a percentage of the voting token's total
- 7.5 High severity
openzeppelin-contracts: Improper Verification of Cryptographic Signature
OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. `SignatureChecker.isValidSignatureNow` is not expected to revert. However, an incorrect assumption about Solidity 0
- 7.5 High severity
openzeppelin-contracts: Unchecked Return Value
OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning `false`. `ERC165Checker.supportsInterface` is designed to always successfully return a boolean, and un