CVE-2023-34234 Governor proposal creation may be blocked by frontrunning in OpenZeppelin
Attackers can frontrun proposal creation to block governance actions or gain proposer privileges in OpenZeppelin smart contracts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-34234?
CVE-2023-34234 is a medium-severity vulnerability in openzeppelin-contracts, published on 7 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0. This problem has been patched in 4.9.1 by introducing opt-in frontrunning protection. Users are advised to upgrade. Users unable to upgrade may submit the proposal creation transaction to an endpoint with frontrunning protection as a workaround.
Weakness: CWE-862
Which versions are affected by CVE-2023-34234?
4 open source packages ship an affected version, including @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@openzeppelin/contracts npm | From 4.3.0 | 4.9.1 |
@openzeppelin/contracts npm | From 4.3.0 | 4.9.1 |
@openzeppelin/contracts-upgradeable npm | From 4.3.0 | 4.9.1 |
@openzeppelin/contracts-upgradeable npm | From 4.3.0 | 4.9.1 |
Products include Openzeppelin Contracts, Openzeppelin Contracts Upgradeable.
How do I fix CVE-2023-34234?
Upgrade @openzeppelin/contracts to 4.9.1 or later.
Is CVE-2023-34234 being exploited?
There is no known exploitation of CVE-2023-34234 in the wild and no public exploit code.
Other vulnerabilities in openzeppelin-contracts
- CVE-2021-39167 TimelockController vulnerability in OpenZeppelin Contracts
- CVE-2021-39168 TimelockController vulnerability in OpenZeppelin Contracts
- CVE-2021-41264 UUPSUpgradeable vulnerability in OpenZeppelin Contracts
- CVE-2022-35961 ECDSA signature malleability in OpenZeppelin Contracts
- CVE-2022-31198 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts
Sources
Also known as GHSA-5h3x-9wvq-w4m2.