{"id":"GHSA-wmpv-c2jp-j2xg","aliases":[],"status":"published","title":"ERC1155Supply vulnerability in OpenZeppelin Contracts","description":"When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the `ERC1155Supply` extension, total supply is not updated until after the callback, thus during the callback the reported total supply is lower than the real number of tokens in circulation.\n\n### Impact\nIf a system relies on accurately reported supply, an attacker may be able to mint tokens and invoke that system after receiving the token balance but before the supply is updated.\n\n### Patches\nA fix is included in version 4.3.3 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.\n\n### Workarounds\nIf accurate supply is relevant, do not mint tokens to untrusted receivers.\n\n### Credits\nThe issue was identified and reported by @ChainSecurityAudits.\n\n### For more information\nRead [TotalSupply Inconsistency in ERC1155 NFT Tokens](https://medium.com/chainsecurity/totalsupply-inconsistency-in-erc1155-nft-tokens-8f8e3b29f5aa) by @ChainSecurityAudits for a more detailed breakdown.\n\nIf you have any questions or comments about this advisory, email us at security@openzeppelin.com.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-11-15T23:28:18Z","modified":"2023-01-09T05:05:06Z","fixes":[{"ecosystem":"npm","package":"@openzeppelin/contracts","fixed_in":["4.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@openzeppelin/contracts-upgradeable","fixed_in":["4.3.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@openzeppelin/contracts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.3.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@openzeppelin/contracts-upgradeable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.3.3"}]}]},{"source":"osv","ecosystem":"npm","package":"@openzeppelin/contracts","ranges":[{"type":"SEMVER","events":[{"introduced":"4.2.0"},{"fixed":"4.3.3"}]}]},{"source":"osv","ecosystem":"npm","package":"@openzeppelin/contracts-upgradeable","ranges":[{"type":"SEMVER","events":[{"introduced":"4.2.0"},{"fixed":"4.3.3"}]}]}],"references":[{"url":"https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-wmpv-c2jp-j2xg","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wmpv-c2jp-j2xg"},{"url":"https://github.com/OpenZeppelin/openzeppelin-contracts","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-wmpv-c2jp-j2xg","title":"ERC1155Supply vulnerability in OpenZeppelin Contracts","description":"When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the `ERC1155Supply` extension, total supply is not updated until after the callback, thus during the callback the reported total supply is lower than the real number of tokens in circulation.\n\n### Impact\nIf a system relies on accurately reported supply, an attacker may be able to mint tokens and invoke that system after receiving the token balance but before the supply is updated.\n\n### Patches\nA fix is included in version 4.3.3 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.\n\n### Workarounds\nIf accurate supply is relevant, do not mint tokens to untrusted receivers.\n\n### Credits\nThe issue was identified and reported by @ChainSecurityAudits.\n\n### For more information\nRead [TotalSupply Inconsistency in ERC1155 NFT Tokens](https://medium.com/chainsecurity/totalsupply-inconsistency-in-erc1155-nft-tokens-8f8e3b29f5aa) by @ChainSecurityAudits for a more detailed breakdown.\n\nIf you have any questions or comments about this advisory, email us at security@openzeppelin.com.","status":"published","published":"2021-11-15T23:28:18Z","modified":"2023-01-09T05:05:06Z","updated_at":"2026-11-02T14:36:11.367194Z"}],"osv":[{"id":"GHSA-wmpv-c2jp-j2xg","title":"ERC1155Supply vulnerability in OpenZeppelin Contracts","description":"When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the `ERC1155Supply` extension, total supply is not updated until after the callback, thus during the callback the reported total supply is lower than the real number of tokens in circulation.\n\n### Impact\nIf a system relies on accurately reported supply, an attacker may be able to mint tokens and invoke that system after receiving the token balance but before the supply is updated.\n\n### Patches\nA fix is included in version 4.3.3 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.\n\n### Workarounds\nIf accurate supply is relevant, do not mint tokens to untrusted receivers.\n\n### Credits\nThe issue was identified and reported by @ChainSecurityAudits.\n\n### For more information\nRead [TotalSupply Inconsistency in ERC1155 NFT Tokens](https://medium.com/chainsecurity/totalsupply-inconsistency-in-erc1155-nft-tokens-8f8e3b29f5aa) by @ChainSecurityAudits for a more detailed breakdown.\n\nIf you have any questions or comments about this advisory, email us at security@openzeppelin.com.","status":"published","published":"2021-11-15T23:28:18Z","modified":"2021-11-15T22:27:38Z","updated_at":"2026-11-02T15:46:58.767335Z"}]}}