Improper Input Validation Affecting @openzeppelin/contracts package, versions >=4.3.0 <4.8.3


0.0
medium

Snyk CVSS

    Attack Complexity Low
    User Interaction Required
    Integrity High

    Threat Intelligence

    EPSS 0.07% (29th percentile)
Expand this section
NVD
8.8 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-OPENZEPPELINCONTRACTS-5425051
  • published 16 Apr 2023
  • disclosed 16 Apr 2023
  • credit Unknown

How to fix?

Upgrade @openzeppelin/contracts to version 4.8.3 or higher.

Overview

@openzeppelin/contracts is a library for contract development.

Affected versions of this package are vulnerable to Improper Input Validation due to missing signatures length validation of the proposal creation entry point (propose) in GovernorCompatibilityBravo, which allows the creation of proposals with a signatures array shorter than the calldatas array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds, the corresponding actions would eventually execute without any calldata. The ProposalCreated event correctly represents what will eventually execute, but the proposal parameters as queried through getActions appear to respect the originally intended calldata.

Workaround

Ensure that all proposals that pass through governance have equal length signatures and calldatas parameters.