CVE-2022-31170

OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning `false`. `ERC165Checker.supportsInterface` is designed to always successfully return a boolean, and under no circumstance revert. However, an incorrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't implement EIP-165 as expected, specifically if it returns a value other than 0 or 1. The contracts that may be affected are those that use `ERC165Checker` to check for support for an interface and then handle the lack of support in a way other than reverting. The issue was patched in version 4.7.1.

• CWE-20
• CWE-252

• https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552Patch, Third Party Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-qh9x-gcfh-pcrwThird Party Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552Patch, Third Party Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-qh9x-gcfh-pcrwThird Party Advisory

Published

Jul 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31164Tovy is a a staff management system for Roblox groups. A vul…7.5
• CVE-2022-31166XWiki Platform Old Core is a core package for XWiki Platform…8.8
• CVE-2022-31167XWiki Platform Security Parent POM contains the security API…6.5
• CVE-2022-31168Zulip is an open source team chat tool. Due to an incorrect …8.8
• CVE-2022-31169Wasmtime is a standalone runtime for WebAssembly. There is a…7.5
• CVE-2022-3117Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-31171Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-31172OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2022-31173Juniper is a GraphQL server library for Rust. Affected versi…7.5
• CVE-2022-31175CKEditor 5 is a JavaScript rich text editor. A cross-site sc…4.7
• CVE-2022-31176Grafana Image Renderer is a Grafana backend plugin that hand…8.1
• CVE-2022-31177Flask-AppBuilder is an application development framework bui…2.7