OpenZeppelin Contracts's ERC165Checker may revert instead of returning false

Vulnerability

Overview

CVE-2022-31170 affects OpenZeppelin Contracts versions 4.0.0 through 4.7.1. The ERC165Checker.supportsInterface function is designed to always return a boolean value without reverting. However, due to an incorrect assumption about Solidity 0.8's abi.decode behavior, the function can revert if the target contract returns a value other than 0 or 1 when queried for interface support [1][4]. This violates the expected contract of the function.

Exploitation

Conditions

An attacker can trigger this revert by deploying a contract that does not properly implement EIP-165—specifically, one that returns a non-standard value (not 0 or 1) from supportsInterface. Any contract that uses ERC165Checker to check for interface support and then handles the lack of support in a way other than reverting (e.g., by branching on the boolean result) is vulnerable. No special authentication or network position is required; the attacker only needs to interact with the affected contract via a malicious target [1][3].

Impact

Instead of gracefully returning false when an interface is not supported, the call reverts. This can cause denial-of-service conditions in contracts that rely on the boolean return value for control flow, potentially locking funds or breaking critical logic. The impact is limited to contracts that do not revert on missing interface support, but it can be severe in systems where such checks are used for access control or feature detection [4].

Mitigation

The issue is patched in OpenZeppelin Contracts version 4.7.1. Users should upgrade to this version or later. No workaround is provided; upgrading is the recommended action [1][3][4].