CVE-2021-46320

Vulnerability

The initializer modifier in OpenZeppelin Contracts versions up to and including v4.4.0 incorrectly allowed reentrancy during initialization when the initializer function performs an untrusted non-view external call. The issue exists because an exception handling multiple inheritance prevented the modifier from detecting recursive invocations, breaking the guarantee of single execution. This primarily affects minimal proxy patterns where initialization is separated from contract creation [1][3].

Exploitation

An attacker must be able to trigger an initializer function that makes an untrusted external call (e.g., to a contract the attacker controls) before the initializer completes. Through that external call, the attacker re-enters the same initializer function on the same contract instance. This requires the contract to be initialized via a separate transaction (not at deployment time) and the initializer to invoke a non-view call to an address the attacker influences [3].

Impact

Successfully reentering the initializer allows the attacker to re-execute the initialization logic, potentially setting critical state variables (e.g., owner, admin) to attacker-controlled values. This can lead to full compromise of the contract's access control and intended functionality, depending on what the initializer sets [3].

Mitigation

The vulnerability is fixed in OpenZeppelin Contracts v4.4.1 of both @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. The fix introduces the onlyInitializing modifier for use in upgradeable contracts and prevents nested initializer calls. Users should upgrade to v4.4.1 or later. As a workaround, avoid untrusted external calls inside initializer functions [3].