CVE-2023-30541

OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding, the proxy could revert while attempting to decode the arguments from calldata. The probability of an accidental clash is negligible, but one could be caused deliberately and could cause a reduction in availability. The issue has been fixed in version 4.8.3. As a workaround if a function appears to be inaccessible for this reason, it may be possible to craft the calldata such that ABI decoding does not fail at the proxy and the function is properly proxied through.

• CWE-436
• CWE-436

• https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4154Patch
• https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.8.3Release Notes
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-mx2q-35m2-x2rhVendor Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4154Patch
• https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.8.3Release Notes
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-mx2q-35m2-x2rhVendor Advisory

Published

Apr 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30535Snowflake JDBC provides a JDBC type 4 driver that supports c…8.8
• CVE-2023-30536slim/psr7 is a PSR-7 implementation for use with Slim 4. In …6.5
• CVE-2023-30537XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-30538Discourse is an open source platform for community discussio…5.4
• CVE-2023-30539Nextcloud is a personal home server system. Depending on the…8.8
• CVE-2023-30540Nextcloud Talk is a chat, video & audio call extension for N…4.3
• CVE-2023-30542OpenZeppelin Contracts is a library for secure smart contrac…8.8
• CVE-2023-30543@web3-react is a framework for building Ethereum Apps . In a…5.7
• CVE-2023-30544Kiwi TCMS is an open source test management system. In versi…4.3
• CVE-2023-30545PrestaShop is an Open Source e-commerce web application. Pri…6.5
• CVE-2023-30546Contiki-NG is an operating system for Internet of Things dev…7.5
• CVE-2023-30547vm2 is a sandbox that can run untrusted code with whiteliste…10