Skip to content

ERC721Consecutive incorrect balance update with batch of 1

Moderate
frangio published GHSA-878m-3g6q-594q Mar 2, 2023

Package

npm @openzeppelin/contracts (npm)

Affected versions

>=4.8.0 <4.8.2

Patched versions

4.8.2
npm @openzeppelin/contracts-upgradeable (npm)
>=4.8.0 <4.8.2
4.8.2

Description

Impact

The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the balance as reported by balanceOf.

The issue exclusively presents with batches of size 1.

Patches

The issue has been patched in 4.8.2.

Severity

Moderate

CVE ID

CVE-2023-26488

Weaknesses

No CWEs