CVE-2023-34234

    Dashboard / Vulnerabilities / CVE-2023-34234

    CVE-2023-34234

    Published: 7 Jun 2023Last Modified: 12 Aug 2026

    Summary: Governor proposal creation may be blocked by frontrunning in OpenZeppelin

    Details: OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0. This problem has been patched in 4.9.1 by introducing opt-in frontrunning protection. Users are advised to upgrade. Users unable to upgrade may submit the proposal creation transaction to an endpoint with frontrunning protection as a workaround.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34234.json, https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-5h3x-9wvq-w4m2, https://nvd.nist.gov/vuln/detail/CVE-2023-34234, https://github.com/OpenZeppelin/openzeppelin-contracts/commit/d9474327a492f9f310f31bc53f38dbea56ed9a57

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 1d2e15fbd7314f4f60b47d97d9b852aacd5404f7
    Fixed -281550b71c3df9a83e6b80ceefc700852c287570

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-34234 | CVE-DB