CVE-2023-34234
Assigner: GitHub_M
Published: 2023-06-07T17:06:10.154Z
State: PUBLISHED
title: Governor proposal creation may be blocked by frontrunning in OpenZeppelin
problemTypes: descriptions: cweId: CWE-862
description: CWE-862: Missing Authorization
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
affected: vendor: OpenZeppelin
product: openzeppelin-contracts
versions: version: >=4.3.0, < 4.9.1
status: affected
descriptions: value:  OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0. This problem has been patched in 4.9.1 by introducing opt-in frontrunning protection. Users are advised to upgrade. Users unable to upgrade may submit the proposal creation transaction to an endpoint with frontrunning protection as a workaround.
source: advisory: GHSA-5h3x-9wvq-w4m2
discovery: UNKNOWN