Confidential Token Transfer Vulnerability in OpenZeppelin's Experimental Library
CVE-2026-73645
What is CVE-2026-73645?
The OpenZeppelin Confidential Contracts library, utilized for building applications on the Zama fhEVM, contains a vulnerability in the ERC7984 contract prior to version 0.3.1. This vulnerability arises from an internal overflow issue during the _mint operation, which can fail without alerting the user. Specifically, the wrap and onTransferReceived functions in the ERC7984ERC20Wrapper.sol extension do not manage this failure appropriately. Consequently, users can initiate transfers of the underlying token without receiving the corresponding wrapped token secure in a confidential manner, leading to potential loss of funds after approximately 18.4 trillion tokens, as the default rate becomes unmanageable. This issue is addressed in version 0.3.1.
Affected Version(s)
openzeppelin-confidential-contracts < 0.3.1