Threats affecting pkg:github/openzeppelin/openzeppelin-confidential-contracts

CVE-2026-73645 is an integer overflow vulnerability in OpenZeppelin's openzeppelin-confidential-contracts library prior to version 0.3.1. The issue occurs in the ERC7984 contract where an internal _mint operation using an euint64 value can overflow silently. This leads to a scenario where users can transfer underlying tokens without receiving the corresponding confidential wrapped tokens, potentially causing loss of funds after approximately 18.4 trillion tokens are wrapped. The vulnerability is fixed in version 0.3.1.