Unbounded gas consumption in @openzeppelin/contracts

Vulnerability

The EIP-165 supportsInterface function in OpenZeppelin Contracts is designed to query whether a contract implements a given interface. The vulnerability arises because the target contract of such a query can return an arbitrarily large amount of data, leading to unbounded gas consumption. This behavior violates the assumption that supportsInterface has a bounded cost [1][2].

Exploitation

An attacker can exploit this by crafting a malicious contract that returns a large payload in response to a supportsInterface query. Any contract that uses OpenZeppelin's ERC165Checker to verify interface support may then be forced to consume excessive gas when interacting with the attacker's contract. No special privileges are required; the attacker only needs the target contract to call supportsInterface on their malicious contract [3].

Impact

If an attacker triggers unbounded gas consumption, the affected contract's operations may fail due to out-of-gas errors, potentially disrupting functionality or enabling denial-of-service attacks. This can be particularly severe in multi-party smart contract systems where reliability is critical [1][3].

Mitigation

The issue is patched in OpenZeppelin Contracts version 4.7.2. All users are advised to upgrade. No workarounds are available. The fix limits the amount of data read from the supportsInterface return value [3][4].