LiveActive security incident?Get immediate response
CVE Record

CVE-2021-46320: In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most...

In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible, breaking the expectation that there is a single execution.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This issue affects OpenZeppelin contract code up to v4.4.0 where some initializer functions could be reentered before completing. For businesses using upgradeable or proxy-based smart contracts, the concern is unexpected repeated initialization, which can undermine assumptions made during deployment or setup.

Executive priority

Treat as a targeted smart contract risk, not a broad enterprise software emergency. Prioritize teams managing OpenZeppelin-based upgradeable or proxy contracts, especially where contract initialization affects ownership, permissions, or funds.

Technical view

Initializers invoked separately from contract creation, especially in minimal proxy patterns, may be reentered when they perform an untrusted non-view external call. The source says an exception for multiple inheritance allowed reentrancy, breaking the expected single execution of an initializer.

Likely exposure

Exposure is most likely in smart contracts built with OpenZeppelin <=v4.4.0 that use initializer functions outside constructor-time creation, including minimal proxies. The source bundle does not identify specific downstream products or deployments.

Exploitation context

The source bundle does not cite active exploitation, and KEV status is false. Exploitability depends on whether an initializer path makes an untrusted non-view external call before completion.

Researcher notes

The public CVE data provides no CVSS score, CWE, concrete affected CPEs, or exploit confirmation. Analysis should focus on contract-specific initialization behavior and the OpenZeppelin advisory rather than assuming universal impact.

Mitigation direction

  • Inventory OpenZeppelin contract library versions and flag any use at or below v4.4.0.
  • Review the OpenZeppelin advisory for version-specific remediation guidance.
  • Avoid untrusted non-view external calls inside initializer paths until remediation is confirmed.
  • Prioritize review of minimal proxy and upgradeable contract initialization flows.

Validation and detection

  • Identify contracts using initializer functions invoked after contract creation.
  • Check initializer call paths for untrusted non-view external calls.
  • Confirm deployed contracts were built from OpenZeppelin versions above the affected range, where applicable.
  • Review deployment records for proxy or minimal proxy initialization patterns.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-46320 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.