Improper Input Validation Affecting @openzeppelin/contracts-upgradeable package, versions >=4.3.0 <4.8.3
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-OPENZEPPELINCONTRACTSUPGRADEABLE-5425052
- published 16 Apr 2023
- disclosed 16 Apr 2023
- credit Unknown
Introduced: 16 Apr 2023
CVE-2023-30542 Open this link in a new tabHow to fix?
Upgrade @openzeppelin/contracts-upgradeable to version 4.8.3 or higher.
Overview
@openzeppelin/contracts-upgradeable is a Secure Smart Contract library for Solidity.
Affected versions of this package are vulnerable to Improper Input Validation due to missing signatures length validation of the proposal creation entry point (propose) in GovernorCompatibilityBravo, which allows the creation of proposals with a signatures array shorter than the calldatas array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds, the corresponding actions would eventually execute without any calldata.
The ProposalCreated event correctly represents what will eventually execute, but the proposal parameters as queried through getActions appear to respect the originally intended calldata.
Workaround
Ensure that all proposals that pass through governance have equal length signatures and calldatas parameters.