A security vulnerability potentially affecting hundreds of smart contracts that were pre-built using a commonly used open-source library has been reported by Web3 firm Thirdweb.
Smart contract development firm Thirdweb reported a security vulnerability that potentially “impacts a variety of smart contracts across the Web3 ecosystem.”
On Dec.
Highlighting the vulnerability's potential to cause massive damage if not rectified immediately, Thirdweb stated:
“The impacted pre-built contracts include but are not limited to DropERC20, ERC721, ERC1155 (all versions), and AirdropERC20.”
Following the proactive warning to Web3 ecosystem, the firm cautioned users who deployed its contracts before Nov.
IMPORTANT
— thirdweb (@thirdweb) December 5, 2023
On November 20th, 2023 6pm PST, we became aware of a security vulnerability in a commonly used open-source library in the web3 industry.
This impacts a variety of smart contracts across the web3 ecosystem, including some of thirdweb’s pre-built smart contracts.…
Thirdweb also advised developers to help users revoke approvals on all affected contracts using revoke.cash, “which will protect your users if you choose not to mitigate the contract.” Defillama developer “0xngmi” commented on the request to revoke approvals.
btw this seems important, theyre asking to revoke all approvals to third web contracts (you might have interacted with them without knowing as theyre white-labelled, especially if you do stuff around nfts) https://t.co/T1YU9xnIRb
— 0xngmi (@0xngmi) December 5, 2023
Thirdweb has contacted the maintainers of the open-source library at the root of the vulnerability and contacted other teams potentially impacted by the issue.
It also pledged to increase investment in security measures and double bug bounty payouts from $25,000 to $50,000 while implementing a more rigorous auditing process.
