OpenZeppelin Contracts contains Incorrect Calculation

Root

Cause The ERC721Consecutive contract, part of OpenZeppelin Contracts, is designed for efficient batch minting of ERC721 tokens. However, when a batch has size 1 (i.e., a single token is minted), the internal balance update is skipped, leaving the recipient's balance unchanged. This bug exists in versions 4.8.0 and 4.8.1 [1][4].

Exploitation

The issue only manifests when minting with a batch of size 1. An attacker can receive a single token from such a mint and then transfer it. Because the recipient's balance was not incremented during minting, the transfer will decrease the balance below zero, causing an integer underflow. This underflow results in a very large balance being reported by balanceOf [1][3]. No special privileges are needed beyond being the recipient of such a mint.

Impact

An attacker can artificially inflate their balanceOf for the affected ERC721 token, potentially disrupting any application that relies on accurate balance tracking, such as marketplaces or governance mechanisms. However, the impact is limited to scenarios involving batch size 1, and the contract's overall integrity (e.g., token ownership) is not directly compromised [4].

Mitigation

The issue has been patched in version 4.8.2 of the @openzeppelin/contracts package. Users are strongly advised to upgrade to 4.8.2 or later. No workarounds are available for affected versions [1][4]. The fix is included in commit 167bf67ed3907f4a674043496019fa346cee7705 [3].