UUPSUpgradeable vulnerability in OpenZeppelin Contracts

Vulnerability

Upgradeable contracts using the UUPSUpgradeable pattern from OpenZeppelin Contracts versions 4.1.0 through 4.3.1 are vulnerable if the implementation contract is not initialized. The bug allows an attacker to call upgradeTo or upgradeToAndCall on an uninitialized implementation contract, potentially taking control of the proxy's upgrade mechanism [1][2].

Exploitation

An attacker does not need any special privileges; the attack can be executed by directly calling upgradeTo on the uninitialized implementation contract address. The attacker must deploy a malicious implementation and then invoke the upgrade function on the target implementation contract, which lacks the onlyProxy modifier introduced in the fix [4]. No user interaction is required.

Impact

Successful exploitation allows the attacker to upgrade the proxy's implementation to a malicious contract, gaining full control over the proxy's storage and functions. This can lead to complete compromise of the upgradeable contract's state and logic, including theft of funds or data [1][2].

Mitigation

The vulnerability is fixed in OpenZeppelin Contracts v4.3.2 and @openzeppelin/contracts-upgradeable v4.3.2 [4]. Users unable to upgrade should immediately invoke the initializer function on their implementation contracts to initialize them, as described in the security advisory [1].