Executive brief
OpenZeppelin Contracts provides a library used to build decentralized governance systems (DAOs). A flaw in the GovernorVotesQuorumFraction module allows previously defeated proposals to become executable if quorum requirements are lowered and those proposals now meet the new quorum threshold. This could enable unintended governance decisions to be executed retroactively.
Technical details
The vulnerability is a logic flaw (CWE-682) in OpenZeppelin Contracts' GovernorVotesQuorumFraction module, which manages quorum as a percentage of total voting token supply. When governance lowers the quorum percentage via a passed proposal, the system does not retroactively re-evaluate past defeated proposals. Previously defeated proposals that failed only due to insufficient votes relative to the old quorum threshold may now satisfy the new lower threshold and become executable. No special privileges or authentication are required to trigger this—any governance action that lowers quorum can expose the vulnerability. The issue affects versions 4.3.0 through 4.7.1 and is patched in v4.7.2.
Affected products
- OpenZeppelin Contracts 4.3.0 to 4.7.1
- OpenZeppelin Contracts Upgradeable 4.3.0 to 4.7.1
Timeline
- 2022-07-28: disclosed: Vulnerability published by OpenZeppelin
- 2022-08-18: patched: Patch released in version 4.7.2