CVE Reports

Posted on Sep 25 Originally published at cvereports.com

GHSA-29H2-JR22-FRMH: GHSA-29H2-JR22-FRMH: Improper Access Control and Handle Substitution in OpenZeppelin Confidential Contracts

#security #cve #cybersecurity #ghsa

GHSA-29H2-JR22-FRMH: Improper Access Control and Handle Substitution in OpenZeppelin Confidential Contracts

Vulnerability ID: GHSA-29H2-JR22-FRMH
CVSS Score: 7.1
Published: 2026-09-25

A critical access control vulnerability exists in the OpenZeppelin Confidential Contracts library for Fully Homomorphic Encryption (FHE) on EVM networks. Due to missing Access Control List (ACL) verification on encrypted FHE handles returned by untrusted external contracts, malicious actors can perform handle substitution attacks. This allows attackers to harvest unauthorized private FHE handles and leak their underlying plaintext values through logical side-channels in subsequent contract operations.

TL;DR

OpenZeppelin Confidential Contracts prior to v0.3.2, v0.4.2, and v0.5.2 are vulnerable to handle substitution attacks. Untrusted external parties can return arbitrary encrypted handles that are consumed without ACL validation, resulting in side-channel plaintext leaks of private FHE states.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-284: Improper Access Control
Attack Vector: Network
CVSS v4.0 Score: 7.1
Impact: High (Unauthorized disclosure of FHE state plaintext)
Exploit Status: poc
KEV Status: Not Listed

Affected Systems

OpenZeppelin Confidential Contracts library installations on EVM-compatible networks using FHE schemas (such as Zama fhEVM).
@openzeppelin/confidential-contracts: < 0.3.2 (Fixed in: 0.3.2)
@openzeppelin/confidential-contracts: >= 0.4.0-rc.0, < 0.4.2 (Fixed in: 0.4.2)
@openzeppelin/confidential-contracts: >= 0.5.0-rc.0, < 0.5.2 (Fixed in: 0.5.2)

Code Analysis

Commit: 93e75ce

Fix VestingWalletConfidential handle substitution security vulnerability by verifying that the token contract is authorized to access the returned balance handle via the FHE ACL.

Commit: fe0863a

Remediate ERC7984 callback handle substitution vulnerability by adding validation to verify that the transfer recipient is ACL-authorized on the returned callback success handle.

Commit: ee47edf

Refine callback validation logic to permit uninitialized handles to bypass ACL checks, resolving potential denial of service scenarios for non-FHE standard receivers.

Exploit Details

GitHub (Mock Unit Tests): Unit tests in the repository mock the deployment of an unauthorized receiver returning arbitrary victim handles to trigger handle consumption validation failures.

Mitigation Strategies

Upgrade @openzeppelin/confidential-contracts to patched versions (v0.3.2, v0.4.2, or v0.5.2).
Implement rigorous input validation on all FHE handles received from external smart contracts.
Utilize FHE.isAllowed to verify that the returning contract possesses authorization for the handle before processing it.

Remediation Steps:

Open the project package.json file.
Update the '@openzeppelin/confidential-contracts' dependency version to '^0.5.2' (or appropriate corresponding patch version for your branch).
Execute your package manager's install command (npm install, yarn install, or pnpm install) to download the patch.
Recompile and run unit tests, ensuring that mock handles and zero-value transitions execute without unexpected reverts.

References

Read the full report for GHSA-29H2-JR22-FRMH on our website for more details including interactive diagrams and full exploit analysis.

DEV Community