Incorrect openzeppelin version #145
Labels
bug
Something isn't working
duplicate
This issue or pull request already exists
QA (Quality Assurance)
Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax
sponsor disputed
Sponsor cannot duplicate the issue, or otherwise disagrees this is an issue
Lines of code
https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/wfCashBase.sol#L12-L13
https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/proxy/nBeaconProxy.sol#L4
https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/proxy/nUpgradeableBeacon.sol#L4
Vulnerability details
Details
Wrapped fCash uses package
@openzeppelin/contracts
version3.4.2-solc-0.7
. In code, it importsSafeERC20
fromutils
andIERC20Metadata
fromextensions
of ERC20.But in branch
release-v3.4-solc-0.7
ofopenzeppelin-contracts
there is no folderutils
orextensions
.Proof Of Concept
Openzeppelin repo: https://github.com/OpenZeppelin/openzeppelin-contracts/tree/release-v3.4-solc-0.7/contracts/token/ERC20
Recommended Mitigation Steps
Update openzeppelin version (e.g
4.6.0
)The text was updated successfully, but these errors were encountered: