VYPR
← All advisories
Moderate severityNVD Advisory· Published Dec 8, 2023· Updated Aug 2, 2024

Duplicated execution of subcalls in OpenZeppelin Contracts

CVE-2023-49798

Description

OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In the version of Multicall.sol released in @openzeppelin/contracts@4.9.4 and @openzeppelin/contracts-upgradeable@4.9.4, all subcalls are executed twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers. The duplicated delegatecall was removed in version 4.9.5. The 4.9.4 version is marked as deprecated. Users are advised to upgrade. There are no known workarounds for this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

OpenZeppelin Contracts 4.9.4 Multicall.sol bug causes each subcall to execute twice, risking duplicate asset transfers.

Description

A merge conflict resolution error when porting a fix from version 5.0.1 to the 4.9 branch introduced a duplicate line in Multicall.sol. This resulted in functionDelegateCall being called twice for each subcall in versions 4.9.4 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable [1][3].

Exploitation

Any user or contract invoking the multicall function will inadvertently execute each provided calldata twice. No special privileges or external conditions are required; the bug is triggered by normal usage of the Multicall utility [1][4].

Impact

Attackers do not actively exploit this vulnerability, but legitimate users may unintentionally duplicate sensitive operations such as asset transfers, token approvals, or other state-changing calls. This can lead to financial losses or unintended contract states [1][3].

Mitigation

The duplicate functionDelegateCall line was removed in version 4.9.5. Version 4.9.4 is deprecated, and users are strongly advised to upgrade. No known workarounds exist [1][3].

References
  1. NVD - CVE-2023-49798
  2. Duplicated execution of subcalls in v4.9.4
  3. Replace double `functionDelegateCall` · OpenZeppelin/openzeppelin-contracts@88ac712

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@openzeppelin/contractsnpm
>= 4.9.4, < 4.9.54.9.5
@openzeppelin/contracts-upgradeablenpm
>= 4.9.4, < 4.9.54.9.5

Affected products

3

Patches

1
31f9fb9d171f

Transpile 88ac712e

https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeablegithub-actionsDec 8, 2023via ghsa
commit
1 file changed · +0 −1
  • contracts/utils/MulticallUpgradeable.sol+0 −1 modified
    @@ -38,7 +38,6 @@ abstract contract MulticallUpgradeable is Initializable, ContextUpgradeable {
 
         results = new bytes[](data.length);
         for (uint256 i = 0; i < data.length; i++) {
-            results[i] = AddressUpgradeable.functionDelegateCall(address(this), data[i]);
             results[i] = AddressUpgradeable.functionDelegateCall(address(this), bytes.concat(data[i], context));
         }
         return results;

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.