GovernorCompatibilityBravo Incorrect ABI Encoding Vulnerability in @openzeppelin/contracts
Summary
GHSA-m6w8-fq7v-ph4m: GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior. Affects @openzeppelin/contracts versions >= 4.3.0, < 4.4.2. Fixed in 4.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @openzeppelin/contracts package is an open-source library that provides secure and tested implementations of various smart contract components for Ethereum-based applications. It is widely used by developers to build decentralized applications (dApps) and smart contracts. However, a vulnerability has been discovered in the GovernorCompatibilityBravo module of the package, which may lead to unexpected behavior.
Vulnerability Detail
The vulnerability in the GovernorCompatibilityBravo module arises from incorrect ABI encoding. If a governance proposal is created using explicit function signatures, the function calls may have incorrect arguments due to bad ABI encoding. This can result in unexpected behavior and potential security risks. However, it is important to note that this issue has not been observed in instances of the contract found on the chain, and proposal creation through Tally or OpenZeppelin Defender is not affected. The vulnerability has been fixed in version v4.4.2 of the @openzeppelin/contracts package.
How To Fix
Minimum fixed version
4.4.2
This is the first release that contains the fix.
npm install @openzeppelin/contracts@4.4.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the @openzeppelin/contracts package is not immediately feasible, a workaround can be implemented by avoiding the creation of proposals using explicit function signatures. Instead, developers should use the 'propose' function without the 'signatures' argument and create the proposal using the fully ABI-encoded function call, including the function selector in the 'calldatas' argument. For example, 'propose([target], [0], ["0x2fbebd3800..01"])', where '2fbebd38' is the function selector.
Conclusion
The GovernorCompatibilityBravo Incorrect ABI Encoding vulnerability in the @openzeppelin/contracts package can lead to unexpected behavior and potential security risks. It is crucial for developers to update their usage of the package to version v4.4.2 or later to fix the vulnerability. If immediate updating is not possible, the provided workaround should be implemented. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @openzeppelin/contracts →
FAQ
The vulnerability may lead to the creation of governance proposals that execute function calls with incorrect arguments. This can result in unexpected behavior and potential security risks.
No, the vulnerability is present in versions starting from v4.3.0 up to v4.4.1. It has been fixed in version v4.4.2.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the tool will analyze it for vulnerabilities.
No known exploits of this vulnerability have been reported at this time. However, it is recommended to update to the fixed version as soon as possible to mitigate any potential risks.
Yes, you can continue using the @openzeppelin/contracts package. However, it is recommended to implement the provided workaround to avoid the vulnerability until you can update to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for @openzeppelin/contracts.
