GovernorCompatibilityBravo may trim proposal calldata
CVE-2023-30542

6.8MEDIUM

Key Information:

Vendor

Openzeppelin

Status
Openzeppelin-contracts
Vendor
CVE Published:
16 April 2023

What is CVE-2023-30542?

A logic flaw in OpenZeppelin Contracts affects the proposal creation entrypoint ('propose') in the 'GovernorCompatibilityBravo'. This vulnerability allows the creation of proposals with a 'signatures' array shorter than the corresponding 'calldatas' array. As a result, the extra elements in 'calldatas' get overlooked, potentially leading to the execution of actions without the expected calldata if the proposal passes. While the 'ProposalCreated' event accurately reflects the intended execution, querying through 'getActions' can misrepresent the proposal parameters. OpenZeppelin has released a patch in version 4.8.3 to address this issue. As a preventive measure, users are advised to ensure that the lengths of the 'signatures' and 'calldatas' parameters match for all governance proposals.

Affected Version(s)

openzeppelin-contracts >= 4.3.0, < 4.8.3

References

https://github.com/OpenZeppelin/openzeppelin-contracts/se...
x_refsource_CONFIRM
https://github.com/OpenZeppelin/openzeppelin-contracts/re...
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.