CVE-2026-73645: CWE-190: Integer Overflow or Wraparound in OpenZeppelin openzeppelin-confidential-contracts
CVE-2026-73645 is an integer overflow vulnerability in OpenZeppelin's openzeppelin-confidential-contracts library prior to version 0.3.1. The issue occurs in the ERC7984 contract where an internal _mint operation using an euint64 value can overflow silently. This leads to a scenario where users can transfer underlying tokens without receiving the corresponding confidential wrapped tokens, potentially causing loss of funds after approximately 18.4 trillion tokens are wrapped. The vulnerability is fixed in version 0.3.1.
AI Analysis
Technical Summary
OpenZeppelin Confidential Contracts prior to version 0.3.1 contain an integer overflow (CWE-190) in the ERC7984 contract's confidential total supply tracking, which uses an euint64 value. The internal _mint operation can overflow silently, and the wrap and onTransferReceived functions in ERC7984ERC20Wrapper.sol do not handle this failure. As a result, users may transfer the underlying token without receiving the confidential wrapped token, causing loss of funds when the total supply exceeds approximately 18.4 trillion tokens. This vulnerability is addressed in version 0.3.1.
Potential Impact
The vulnerability can cause silent failure of minting confidential wrapped tokens, leading to users losing funds when transferring tokens after the overflow threshold is reached. This affects the integrity of token wrapping and could result in financial loss for users interacting with the affected contracts.
Mitigation Recommendations
Upgrade to OpenZeppelin openzeppelin-confidential-contracts version 0.3.1 or later, where this integer overflow issue is fixed. No other mitigation is indicated.
CVE-2026-73645: CWE-190: Integer Overflow or Wraparound in OpenZeppelin openzeppelin-confidential-contracts
Description
CVE-2026-73645 is an integer overflow vulnerability in OpenZeppelin's openzeppelin-confidential-contracts library prior to version 0.3.1. The issue occurs in the ERC7984 contract where an internal _mint operation using an euint64 value can overflow silently. This leads to a scenario where users can transfer underlying tokens without receiving the corresponding confidential wrapped tokens, potentially causing loss of funds after approximately 18.4 trillion tokens are wrapped. The vulnerability is fixed in version 0.3.1.
CVSS v4.0
Score 6.6medium
Affected software
OpenZeppelin
openzeppelin-confidential-contracts
pkg:github/openzeppelin/openzeppelin-confidential-contractsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenZeppelin Confidential Contracts prior to version 0.3.1 contain an integer overflow (CWE-190) in the ERC7984 contract's confidential total supply tracking, which uses an euint64 value. The internal _mint operation can overflow silently, and the wrap and onTransferReceived functions in ERC7984ERC20Wrapper.sol do not handle this failure. As a result, users may transfer the underlying token without receiving the confidential wrapped token, causing loss of funds when the total supply exceeds approximately 18.4 trillion tokens. This vulnerability is addressed in version 0.3.1.
Potential Impact
The vulnerability can cause silent failure of minting confidential wrapped tokens, leading to users losing funds when transferring tokens after the overflow threshold is reached. This affects the integrity of token wrapping and could result in financial loss for users interacting with the affected contracts.
Mitigation Recommendations
Upgrade to OpenZeppelin openzeppelin-confidential-contracts version 0.3.1 or later, where this integer overflow issue is fixed. No other mitigation is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-13T14:04:09.604Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a7e08efbf8831d5399b79a5
Added to database: 08/13/2026, 18:11:59 UTC
Last enriched: 08/21/2026, 13:31:58 UTC
Last updated: 09/26/2026, 05:53:03 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.