OpenZeppelin
Hack or exploit on Sep 3, 2021 · Contract Vulnerability
What happened
OpenZeppelin released a bug fix analysis. Whitehat Zb3 submitted a serious reentrant vulnerability in OpenZeppelin's TimelockController contract on August 21, 2021, which affected a project hosted on the Immunefi vulnerability bounty platform. The project chose to remain anonymous and has paid an undisclosed amount (including an anonymous bonus) to White Hat. OpenZeppelin paid White Hat a bonus of $25,000 to recognize their contribution to community security and released a patch. As far as it knows, this is the only serious vulnerability that OpenZeppelin has in its open source smart contract library. The vulnerability has been patched in the affected projects, and OpenZeppelin has released an updated contract version to fix the vulnerability. All projects that use TimelockController should be migrated.
Details
- Date
- Sep 3, 2021
- Kind
- Hack or exploit
- Method
- Contract Vulnerability
- How in
- Smart contract bug
- Target
- not stated
- Chains
- not stated
Reported by
Related incidents
pNetwork 2021 · Hack or exploit · $12M
bEarn Fi 2021 · Hack or exploit · $11M
Visor Finance 2021 · Hack or exploit · $8.2M
Gelato Network 2021 · Hack or exploit · $744K
SwanBluechip, "OpenZeppelin hack, Sep 3, 2021: undisclosed lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/hte56c63701d/ (data as of 2026-10-31).