CVE-2023-23940

CVE-2023-23940 is a medium-severity vulnerability affecting OpenZeppelin Contracts for Cairo, specifically within the `is_valid_eth_signature` function. A missing call to `finalize_keccak` allows a malicious sequencer to bypass signature validation, enabling impersonation of accounts utilizing this function, such as those based on the `EthAccount` preset. The vulnerability has a CVSS score of 5.3 (Medium), indicating a network-based attack with high complexity and potential for high confidentiality impact. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.