Web3 has discovered a vulnerability in a widely used open source library that impacts the security of pre-built smart contracts, including several NFT collections, including those on the Coinbase platform. The announcement was made by Web3 development company Thirdweb, although minimal details of the vulnerability were provided, causing concern among users seeking further clarification to secure their contracts.
Thirdweb states that they discovered the vulnerability on November 20 and offered a fix two days later. However, they did not disclose the name of the library or the type and severity of the vulnerability to avoid alerting attackers. They claim that they have already contacted the maintainers of the vulnerable library and alerted other protocols and organizations, providing their findings and suggestions to fix the problem.
The vulnerability affects several types of smart contracts, including AirdropERC20, ERC721, ERC1155, BurnToClaimDropERC721, DropERC20, ERC721, ERC1155, DiscountCard, TradingPlatformV3, Multiwrap_OSRoyaltyFilter, OpenEditionERC721, Pack_OSRoyaltyFilter, TieredDrop, TokenERC20, ECRC721, ERC1155, SignatureDrop, NFTStake, EditionStake, and others.
Thirdweb recommends that smart contract owners take immediate mitigation action for all contracts created before November 22, 2023. The recommendation is to lock vulnerable contracts, take a snapshot, and then migrate it to a new contract created using an updated version of the library.
Users expressed their dissatisfaction with the lack of detail and transparency. One user requested the CVE vulnerability ID and a detailed explanation of the remediation process. Thirdweb offered retroactive gas grants to cover the cost of fixing the vulnerability, provided users provided the information.
The alert has also impacted valuable NFT holders, and major NFT trading platforms such as Coinbase and OpenSea have already taken steps to mitigate risks and secure user assets. OpenZeppelin, developers of another library for smart contracts, have also been informed of the problem and have indicated that it is not related to their library implementation.
Thus, the Web3 community is actively responding to the discovered vulnerability, taking steps to address it and ensure the security of smart contracts and user assets.
