CVE-2023-34234
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
The OpenZeppelin Contracts library for smart contract development has a vulnerability that allows an attacker to take over the proposer role by frontrunning the creation of a proposal. The attacker can repeatedly attempt to prevent a proposal from being proposed.
Risk Assessment
The organization may be exposed to manipulation in the decision-making process, potentially leading to inefficient management and financial losses.
Recommendation
It is recommended to upgrade to version 4.9.1, which introduces frontrunning protection. Users unable to upgrade should submit proposal creation transactions to an endpoint with frontrunning protection.
Original NVD description (English source)
OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0. This problem has been patched in 4.9.1 by introducing opt-in frontrunning protection. Users are advised to upgrade. Users unable to upgrade may submit the proposal creation transaction to an endpoint with frontrunning protection as a workaround.