Most recent entries from all

EUVD-2026-214036

2026-10-04T05:29:58.014269+00:00

EUVD-2026-214036

fkie_cve-2023-34234

2026-10-04T05:29:58.014306+00:00

OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0. This problem has been patched in 4.9.1 by introducing opt-in frontrunning protection. Users are advised to upgrade. Users unable to upgrade may submit the proposal creation transaction to an endpoint with frontrunning protection as a workaround.

GHSA-5h3x-9wvq-w4m2 — OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning

2026-10-04T05:29:58.014340+00:00

Affected: npm: @openzeppelin/contracts, npm: @openzeppelin/contracts-upgradeable

### Impact

By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all.

This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0.

### Patches

The problem has been patched in 4.9.1 by introducing opt-in frontrunning protection.

### Workarounds

Submit the proposal creation transaction to an endpoint with frontrunning protection.

### Credit

Reported by Lior Abadi and Joaquin Pereyra from Coinspect.

### References

https://www.coinspect.com/openzeppelin-governor-dos/

gsd-2023-34234

2026-10-04T05:29:58.014378+00:00

gsd-2023-34234