Listen to this Post
The vulnerability exists in the ERC7984ERC20Wrapper contract which implements a confidential token wrapper. It uses an internal `_mint` function that operates on a confidential `euint64` total supply variable. When the total supply reaches the maximum value for `euint64` (2^64 – 1), any subsequent call to `_mint` will overflow and fail silently without reverting the transaction. The wrapper’s `wrap` and `onTransferReceived` functions call `_mint` but do not check its return value, assuming a mint failure would always revert. Consequently, once the wrapper’s capacity is filled (~18.4 trillion tokens at a 1:1 rate), users can still call `wrap` and successfully transfer their underlying tokens to the contract. However, the silent mint failure means they receive zero wrapped tokens in return, leading to a permanent loss of the underlying assets.
Platform: OpenZeppelin Confidential Contracts
Version: <= 0.3.0
Vulnerability: Silent Mint Failure
Severity: Moderate
date: Jan 5, 2026
Prediction: Patched (0.3.1)
What Undercode Say:
Showing bash commands and codes related to the blog
npm list @openzeppelin/contracts-confidential
// Vulnerable code pattern
function wrap(uint256 amount) external {
underlying.transferFrom(msg.sender, address(this), amount);
_mint(msg.sender, amount); // Silent failure on overflow
}
how Exploit:
1. Attacker fills wrapper capacity.
2. Victim calls `wrap()` function.
3. Underlying tokens transfer.
4. `_mint` silently fails.
5. Victim receives zero.
Protection from this CVE
Upgrade to v0.3.1.
Implement return value checks.
Use safe math operations.
Impact:
Funds loss.
Silent transaction failure.
Wrapper capacity exhaustion.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
