OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts (vanilla and ethereum flavors) in the v0.2.0 release of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet. Only goerli deployments of v0.2.0 accounts are affected. This faulty behavior is not observed in StarkNets testing framework. This bug has been patched in v0.2.1.
The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Contracts | Openzeppelin | 0.2.0 (including) | 0.2.0 (including) |
Resources often have explicit instructions on how to be created, used and destroyed. When code does not follow these instructions, it can lead to unexpected behaviors and potentially exploitable states. Even without explicit instructions, various principles are expected to be adhered to, such as “Do not use an object until after its creation is complete,” or “do not use an object after it has been slated for destruction.”