Governor proposal creation may be blocked by frontrunning in OpenZeppelin
CVE-2023-34234

5.3MEDIUM

Key Information:

Vendor

Openzeppelin

Status
Openzeppelin-contracts
Vendor
CVE Published:
7 June 2023

What is CVE-2023-34234?

OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the Governor contract in v4.9.0 only, and the GovernorCompatibilityBravo contract since v4.3.0. This problem has been patched in 4.9.1 by introducing opt-in frontrunning protection. Users are advised to upgrade. Users unable to upgrade may submit the proposal creation transaction to an endpoint with frontrunning protection as a workaround.

Affected Version(s)

openzeppelin-contracts >=4.3.0, < 4.9.1

References

https://github.com/OpenZeppelin/openzeppelin-contracts/se...
x_refsource_CONFIRM
https://github.com/OpenZeppelin/openzeppelin-contracts/co...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.