-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe core vulnerability exists in the proposal creation flow where authorization checks were insufficient. The patch added _isValidDescriptionForProposer to enforce proposer authorization via a description suffix. The vulnerable versions' propose functions (in both Governor and GovernorCompatibilityBravo) lacked this critical check, enabling frontrunning attacks. The CWE-862 (Missing Authorization) confirmation and commit diff showing the security check addition to propose() further validate this assessment.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @openzeppelin/contracts | npm | >= 4.3.0, < 4.9.1 | 4.9.1 |
| @openzeppelin/contracts-upgradeable | npm | >= 4.3.0, < 4.9.1 | 4.9.1 |