{"vulnerability": "GHSA-29H2-JR22-FRMH", "sightings": [{"uuid": "27357a4d-c960-4934-b37c-c070f6d17389", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-29H2-JR22-FRMH", "type": "seen", "source": "https://gist.github.com/alon710/91368018d6f66ee7f4ed035c84f84a55", "content": "# GHSA-29H2-JR22-FRMH: GHSA-29H2-JR22-FRMH: Improper Access Control and Handle Substitution in OpenZeppelin Confidential Contracts\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/GHSA-29H2-JR22-FRMH\n\n## Summary\nA critical access control vulnerability exists in the OpenZeppelin Confidential Contracts library for Fully Homomorphic Encryption (FHE) on EVM networks. Due to missing Access Control List (ACL) verification on encrypted FHE handles returned by untrusted external contracts, malicious actors can perform handle substitution attacks. This allows attackers to harvest unauthorized private FHE handles and leak their underlying plaintext values through logical side-channels in subsequent contract operations.\n\n## TL;DR\nOpenZeppelin Confidential Contracts prior to v0.3.2, v0.4.2, and v0.5.2 are vulnerable to handle substitution attacks. Untrusted external parties can return arbitrary encrypted handles that are consumed without ACL validation, resulting in side-channel plaintext leaks of private FHE states.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-284: Improper Access Control\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 7.1\n- **Impact**: High (Unauthorized disclosure of FHE state plaintext)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenZeppelin Confidential Contracts library installations on EVM-compatible networks using FHE schemas (such as Zama fhEVM).\n- **@openzeppelin/confidential-contracts**: < 0.3.2 (Fixed in: `0.3.2`)\n- **@openzeppelin/confidential-contracts**: >= 0.4.0-rc.0, < 0.4.2 (Fixed in: `0.4.2`)\n- **@openzeppelin/confidential-contracts**: >= 0.5.0-rc.0, < 0.5.2 (Fixed in: `0.5.2`)\n\n## Mitigation\n\n- Upgrade @openzeppelin/confidential-contracts to patched versions (v0.3.2, v0.4.2, or v0.5.2).\n- Implement rigorous input validation on all FHE handles received from external smart contracts.\n- Utilize FHE.isAllowed to verify that the returning contract possesses authorization for the handle before processing it.\n\n**Remediation Steps:**\n1. Open the project package.json file.\n2. Update the '@openzeppelin/confidential-contracts' dependency version to '^0.5.2' (or appropriate corresponding patch version for your branch).\n3. Execute your package manager's install command (npm install, yarn install, or pnpm install) to download the patch.\n4. Recompile and run unit tests, ensuring that mock handles and zero-value transitions execute without unexpected reverts.\n\n## References\n\n- [GitHub Security Advisory GHSA-29H2-JR22-FRMH](https://github.com/advisories/GHSA-29H2-JR22-FRMH)\n- [Pull Request #423: Vesting Wallet Fix](https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/pull/423)\n- [Pull Request #428: ERC7984 Callback Fix](https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/pull/428)\n- [Pull Request #431: Uninitialized Return Fix](https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/pull/431)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-29H2-JR22-FRMH) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T21:30:32.000000Z"}]}