PT-2022-20606 · Openzeppelin · Openzeppelin Contracts

Published 2022-08-01 · Updated 2022-12-06 · CVE-2022-31198

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts versions prior to 4.7.2

Description This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a proposal is passed to lower the quorum requirements, past proposals may become executable if they had been defeated only due to lack of quorum, and the number of votes it received meets the new quorum requirement. Analysis of instances on chain found only one proposal that met this condition, and the issue is being actively monitored for new occurrences.

Recommendations For versions prior to 4.7.2, upgrade to v4.7.2 to resolve the issue. As a temporary workaround for users unable to upgrade, consider avoiding lowering quorum requirements if a past proposal was defeated for lack of quorum.

Exploit

Fix

Weakness Enumeration

CWE-682

Related Identifiers

CVE-2022-31198

GHSA-XRC4-737V-9Q75

Affected Products

Openzeppelin Contracts

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31198.json · Exploit
• https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3561 · Patch
• https://osv.dev/vulnerability/CVE-2022-31198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31198 · Security Note
• https://osv.dev/vulnerability/GHSA-xrc4-737v-9q75 · Vendor Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts · Note
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-xrc4-737v-9q75 · Note
• https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.7.2 · Note
• https://t.me/cibsecurity/47388 · Telegram Post