diff --git a/.changeset/large-humans-remain.md b/.changeset/large-humans-remain.md new file mode 100644 index 00000000000..95b72aea463 --- /dev/null +++ b/.changeset/large-humans-remain.md @@ -0,0 +1,5 @@ +--- +'openzeppelin-solidity': patch +--- + +`MerkleProof`: Use custom error to report invalid multiproof instead of reverting with overflow panic. diff --git a/contracts/utils/cryptography/MerkleProof.sol b/contracts/utils/cryptography/MerkleProof.sol index b42a080c8f6..a1f5129f058 100644 --- a/contracts/utils/cryptography/MerkleProof.sol +++ b/contracts/utils/cryptography/MerkleProof.sol @@ -118,7 +118,7 @@ library MerkleProof { uint256 totalHashes = proofFlags.length; // Check proof validity. - if (leavesLen + proofLen - 1 != totalHashes) { + if (leavesLen + proofLen != totalHashes + 1) { revert MerkleProofInvalidMultiproof(); } @@ -174,7 +174,7 @@ library MerkleProof { uint256 totalHashes = proofFlags.length; // Check proof validity. - if (leavesLen + proofLen - 1 != totalHashes) { + if (leavesLen + proofLen != totalHashes + 1) { revert MerkleProofInvalidMultiproof(); }