MEDIUM6.5

GHSA-878m-3g6q-594q

OpenZeppelin Contracts contains Incorrect Calculation

Quick fix

GHSA-878m-3g6q-594q — @openzeppelin/contracts: upgrade to the fixed version with the command below.

npm install @openzeppelin/contracts@4.8.2

Details

### Impact

The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the balance as reported by `balanceOf`.

The issue exclusively presents with batches of size 1.

### Patches

The issue has been patched in 4.8.2.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@openzeppelin/contracts

Introduced in: 4.8.0Fixed in: 4.8.2

Fixnpm install @openzeppelin/contracts@4.8.2

npm/@openzeppelin/contracts-upgradeable

Introduced in: 4.8.0Fixed in: 4.8.2

Fixnpm install @openzeppelin/contracts-upgradeable@4.8.2

References

https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-878m-3g6q-594q[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2023-26488[ADVISORY]
https://github.com/OpenZeppelin/openzeppelin-contracts/commit/167bf67ed3907f4a674043496019fa346cee7705[WEB]
https://github.com/OpenZeppelin/openzeppelin-contracts[PACKAGE]
https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.8.2[WEB]