CVE-2026-73645 OpenZeppelin CVE debrief

Who should care

Defenders responsible for OpenZeppelin Confidential Contracts deployments, especially those using versions prior to 0.3.1, should assess potential exposure and verify their inventory. They should also review and update their systems to use the patched version.

Why it matters

CVE-2026-73645 vulnerability in OpenZeppelin Confidential Contracts could allow users to transfer tokens without receiving wrapped tokens. Defenders should verify their inventory, assess exposure, and update to version 0.3.1.

• Potential loss of tokens due to silent failure in _mint operations
• Exposure to token transfer without receiving wrapped tokens
• Need for verification of OpenZeppelin Confidential Contracts usage and version assessment

Technical summary

The ERC7984 contract in OpenZeppelin Confidential Contracts tracked confidential total supply with an euint64 value. An overflowing internal _mint operation could fail silently, allowing users to transfer underlying tokens without receiving corresponding confidential wrapped tokens. The wrap and onTransferReceived functions did not handle this failure. The issue is fixed in version 0.3.1. The vulnerability can cause loss of funds, and defenders should prioritize verifying their inventory of OpenZeppelin Confidential Contracts usage, especially versions prior to 0.3.1, and assess potential exposure to token loss.

Defensive priority

Defenders should prioritize verifying their inventory of OpenZeppelin Confidential Contracts usage, especially versions prior to 0.3.1, and assess potential exposure to token loss. They should also review and update their systems to use the patched version.

Recommended defensive actions

• Verify inventory of OpenZeppelin Confidential Contracts usage, especially versions prior to 0.3.1.
• Assess potential exposure to token loss.
• Review and update systems to use the patched version 0.3.1.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The issue is fixed in version 0.3.1 of OpenZeppelin Confidential Contracts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.