OpenZeppelin Discloses 'High Severity Vulnerability' in DeFi Wallet Argent

A “high severity vulnerability” was found and patched in Ethereum wallet Argent, according to leading white-hat hackers OpenZeppelin.

AccessTimeIconJun 19, 2020 at 3:28 p.m. UTC
Updated Sep 14, 2021 at 8:54 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

A “high severity vulnerability” was found and patched in Ethereum wallet Argent, according to leading white-hat hackers OpenZeppelin.

Disclosed Friday, OpenZeppelin security researcher Alice Henshaw discovered a vulnerability within Argent that would have allowed user funds to be drained from wallets that did not have Argent’s “guardian” feature. 

According to an OpenZepplin blog post and press release, news of the discovery was first shared with Argent on June 12:

“OpenZeppelin’s research revealed an error in the latest version of Argent’s smart contracts that would allow anyone to trigger the wallet recovery process without a signature – on any wallet with zero guardians – as soon as the wallet is upgraded.”

If attacked, users had only 36 hours to prevent drainage of wallet funds. Even then, users could have their funds frozen through a Denial-of-Service (DoS) attack, OpenZeppelin wrote.

According to Henshaw, the vulnerability stemmed from a March 30 wallet update. OpenZeppelin said 329 wallets with 162 ether (ETH) and undisclosed decentralized finance (DeFi) tokens were at risk. Another 5,513 wallets were vulnerable as well, once they updated to the new Argent software, the blog states.

No Argent funds were affected and a patch has been issued, according to the firm. Henshaw received $25,000 in dai as compensation.

“Only 61 wallets without Guardians and with the affected update were at risk,” Argent spokesman Matthew Wright told CoinDesk. “Our security model meant they had 36 hours to block it by simply tapping ‘Cancel’ in the app. 0 funds were lost. We think it highlights the benefits of having an open-source security model and we’re happy to award OpenZeppelin a bounty for their work.”

Argent acknowledged the vulnerability in a tweet Friday morning, thanking OpenZeppelin for its work:

In March, Argent raised $12 million in a Series A led by Paradigm Ventures. The wallet natively integrates with popular DeFi products such as Maker and Compound.

“The vulnerability discovered by our security researchers could have led to many users losing control of their funds as they upgraded to the latest version of the Argent wallet,” OpenZeppelin CEO Demian Brener said in a statement. “The Argent team has taken quick action to fix this issue so that no user funds were impacted.”


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is an award-winning media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. In November 2023, CoinDesk was acquired by Bullish group, owner of Bullish, a regulated, institutional digital assets exchange. Bullish group is majority owned by; both groups have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary, and an editorial committee, chaired by a former editor-in-chief of The Wall Street Journal, is being formed to support journalistic integrity.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.