CVE-2026-73645

Received Received - Intake

Integer Overflow in OpenZeppelin Confidential Contracts

Publication date: 2026-08-13

Last updated on: 2026-08-14

Assigner: GitHub, Inc.

Description

OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0.3.1, the ERC7984 contract tracked confidential total supply with an euint64 value, and an overflowing internal _mint operation could fail silently. The wrap and onTransferReceived functions in contracts/token/ERC7984/extensions/ERC7984ERC20Wrapper.sol did not handle that failure, so a user could transfer the underlying token without receiving the corresponding confidential wrapped token. With the default rate(), the wrapper fills after approximately 18.4 trillion tokens, and subsequent wrapping requests can cause loss of funds. This issue is fixed in version 0.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-14

Generated

2026-09-03

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-02

NVD

CVE-2026-73645

EUVD

EUVD-2026-58188

Affected Vendors & Products

Vendor	Product	Version / Range
openzeppelin	confidential_contracts	0.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability affects the OpenZeppelin Confidential Contracts library, specifically the ERC7984ERC20Wrapper contract. It involves a silent failure when the total supply of confidential wrapped tokens overflows. The _mint function fails silently during overflow, and the wrap and onTransferReceived functions do not handle this failure, causing users to send underlying tokens without receiving the corresponding wrapped tokens.

Detection Guidance

Detecting this vulnerability requires checking if your system uses OpenZeppelin Confidential Contracts versions prior to 0.3.1. Review deployed contracts for ERC7984ERC20Wrapper.sol and verify if the _mint function fails silently during overflow. Check transaction logs for failed wrap operations or fund transfers without corresponding wrapped tokens.

Impact Analysis

Users could lose funds by transferring underlying tokens without receiving the corresponding confidential wrapped tokens. This happens when the wrapper reaches its maximum capacity of approximately 18.4 trillion tokens, causing wrap requests to fail silently. The default rate may cause this issue even for tokens with lower supply.

Compliance Impact

This vulnerability could lead to loss of funds due to silent failures in token transfers, which may violate financial record-keeping and integrity requirements under GDPR and HIPAA. Specifically, the inability to track or recover lost tokens during overflow conditions may conflict with data accuracy and accountability principles.

Mitigation Strategies

Immediately upgrade to OpenZeppelin Confidential Contracts version 0.3.1 or later. Review all ERC7984ERC20Wrapper contracts for potential overflow issues. Monitor transactions for failed wrap operations and ensure no funds were lost due to silent failures.

Hi! I’m here to help you understand CVE-2026-73645. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70