PT-2022-28259 · Openzeppelin · Openzeppelin Contracts+1
Published
2022-01-13
·
Updated
2022-01-13
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
@openzeppelin/contracts versions prior to v4.4.2
@openzeppelin/contracts-upgradeable versions prior to v4.4.2
Description
The issue arises from the
GovernorCompatibilityBravo module, which may lead to the creation of governance proposals that execute function calls with incorrect arguments due to bad ABI encoding. This occurs when a proposal is created using explicit function signatures. For example, a proposal to invoke the function foo(uint256) created as propose([target],[0],["foo(uint256)"],["0x00..01"]) is vulnerable. However, if the function selector is provided as part of the encoded proposal data, the issue is not present. No occurrences of this bug have been found in the past, and proposal creation through Tally or OpenZeppelin Defender is not affected. The core Governor contract on its own is also not affected.Recommendations
For @openzeppelin/contracts versions prior to v4.4.2, update to version v4.4.2 or later.
For @openzeppelin/contracts-upgradeable versions prior to v4.4.2, update to version v4.4.2 or later.
As a temporary workaround, do not create proposals using explicit function signatures. Instead, use the
propose function without the signatures argument, and create the proposal using the fully ABI-encoded function call including the function selector in the calldatas argument. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openzeppelin Contracts
@Openzeppelin/Contracts-Upgradeable