# CVE-2022-31198: OpenZeppelin Contracts GovernorVotesQuorumFraction logic flaw

Source: https://junglewise.ai/threats/cve-2022-31198-openzeppelin-contracts-governorvotesquorumfraction-logic-flaw  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-31198 · Severity: low · CVSS 3.1 · Published 2022-08-18

OpenZeppelin Contracts provides a library used to build decentralized governance systems (DAOs). A flaw in the GovernorVotesQuorumFraction module allows previously defeated proposals to become executable if quorum requirements are lowered and those proposals now meet the new quorum threshold. This could enable unintended governance decisions to be executed retroactively.

Technologies: [@openzeppelin/contracts (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts), [@openzeppelin/contracts-upgradeable (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts-upgradeable), [OpenZeppelin Contracts](https://junglewise.ai/threats/technologies/contracts), [OpenZeppelin Contracts Upgradeable](https://junglewise.ai/threats/technologies/contracts-upgradeable). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [OpenZeppelin](https://junglewise.ai/threats/vendors/openzeppelin).

## Quick answers

**Is CVE-2022-31198 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-31198 being exploited in the wild.

**How severe is CVE-2022-31198?** Low severity, with a CVSS score of 3.1, published 18 August 2022.

**Which products and versions are affected?** @openzeppelin/contracts (npm) SEMVER:introduced=4.3.0,fixed=4.7.2; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.3.0,fixed=4.7.2; OpenZeppelin Contracts 4.3.0 to 4.7.1; OpenZeppelin Contracts Upgradeable 4.3.0 to 4.7.1.

**Is there a fix for CVE-2022-31198?** Yes. @openzeppelin/contracts (npm): upgrade to 4.7.2 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-31198 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-31198?** Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @openzeppelin/contracts (npm): upgrade to 4.7.2 or later

  ```sh
  npm install @openzeppelin/contracts@4.7.2
  ```

- @openzeppelin/contracts-upgradeable (npm): upgrade to 4.7.2 or later

  ```sh
  npm install @openzeppelin/contracts-upgradeable@4.7.2
  ```


## Technical details

The vulnerability is a logic flaw (CWE-682) in OpenZeppelin Contracts' GovernorVotesQuorumFraction module, which manages quorum as a percentage of total voting token supply. When governance lowers the quorum percentage via a passed proposal, the system does not retroactively re-evaluate past defeated proposals. Previously defeated proposals that failed only due to insufficient votes relative to the old quorum threshold may now satisfy the new lower threshold and become executable. No special privileges or authentication are required to trigger this—any governance action that lowers quorum can expose the vulnerability. The issue affects versions 4.3.0 through 4.7.1 and is patched in v4.7.2.

## Affected products

- OpenZeppelin Contracts 4.3.0 to 4.7.1
- OpenZeppelin Contracts Upgradeable 4.3.0 to 4.7.1

## Identifiers

- CVE-2022-31198
- GHSA-xrc4-737v-9q75

## Timeline

- 2022-07-28: disclosed: Vulnerability published by OpenZeppelin
- 2022-08-18: patched: Patch released in version 4.7.2

## References

- [https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-xrc4-737v-9q75](https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-xrc4-737v-9q75)

## Related threats

- [OpenZeppelin Contracts information disclosure in VestingWalletConfidential](https://junglewise.ai/threats/openzeppelin-confidential-contracts-vestingwalletconfidential-a-14aa72cf)
- [OpenZeppelin Contracts out-of-bounds memory access in Bytes.lastIndexOf](https://junglewise.ai/threats/cve-2025-54070-openzeppelin-contracts-out-of-bounds-memory-access-in-bytes)
- [OpenZeppelin Contracts base64 encoding reads from dirty memory](https://junglewise.ai/threats/cve-2024-27094-openzeppelin-contracts-base64-encoding-reads-from-dirty-memory)
- [OpenZeppelin Contracts duplicated execution in Multicall](https://junglewise.ai/threats/cve-2023-49798-openzeppelin-contracts-duplicated-execution-in-multicall)
- [OpenZeppelin Contracts improper escaping in ERC2771Context](https://junglewise.ai/threats/cve-2023-40014-openzeppelin-contracts-improper-escaping-in-erc2771context)