# CVE-2023-30542: OpenZeppelin Contracts GovernorCompatibilityBravo calldata trimming

Source: https://junglewise.ai/threats/cve-2023-30542-openzeppelin-contracts-governorcompatibilitybravo-calldata  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-04-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-30542 · Severity: low · CVSS 3.1 · Published 2023-04-20

OpenZeppelin Contracts is a widely-used library for building Ethereum smart contracts, particularly governance systems. A flaw in the GovernorCompatibilityBravo component allows proposals to be created with mismatched parameter arrays, causing intended transaction data to be silently discarded during execution. This creates a mismatch between what governance participants approve and what actually executes, potentially allowing actions to run without their expected parameters.

Technologies: [@openzeppelin/contracts (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts), [@openzeppelin/contracts-upgradeable (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts-upgradeable), [OpenZeppelin Contracts](https://junglewise.ai/threats/technologies/contracts), [OpenZeppelin Contracts Upgradeable](https://junglewise.ai/threats/technologies/contracts-upgradeable). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [OpenZeppelin](https://junglewise.ai/threats/vendors/openzeppelin).

## Quick answers

**Is CVE-2023-30542 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-30542 being exploited in the wild.

**How severe is CVE-2023-30542?** Low severity, with a CVSS score of 3.1, published 20 April 2023.

**Which products and versions are affected?** @openzeppelin/contracts (npm) SEMVER:introduced=4.3.0,fixed=4.8.3; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.3.0,fixed=4.8.3; OpenZeppelin Contracts 4.3.0 through 4.8.2; OpenZeppelin Contracts Upgradeable 4.3.0 through 4.8.2.

**Is there a fix for CVE-2023-30542?** Yes. @openzeppelin/contracts (npm): upgrade to 4.8.3 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-30542 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-30542?** Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @openzeppelin/contracts (npm): upgrade to 4.8.3 or later

  ```sh
  npm install @openzeppelin/contracts@4.8.3
  ```

- @openzeppelin/contracts-upgradeable (npm): upgrade to 4.8.3 or later

  ```sh
  npm install @openzeppelin/contracts-upgradeable@4.8.3
  ```


## Technical details

The vulnerability is an input validation flaw (CWE-20) in GovernorCompatibilityBravo's propose() function, which fails to validate that the signatures and calldatas arrays have equal length. When signatures is shorter than calldatas, the excess calldata elements are silently trimmed during execution. While the ProposalCreated event correctly reflects the truncated execution, getActions() returns the original, full calldata array, creating an information disclosure and creating discrepancy between governance approval and actual execution. The vulnerability affects versions 4.3.0 through 4.8.2 and is fixed in v4.8.3. The attack requires authorization to create proposals (typically token voting) but no user interaction or network-level privileges.

## Affected products

- OpenZeppelin Contracts 4.3.0 through 4.8.2
- OpenZeppelin Contracts Upgradeable 4.3.0 through 4.8.2

## Identifiers

- CVE-2023-30542
- GHSA-93hq-5wgc-jc82

## Timeline

- 2023-04-13: disclosed: Vulnerability published in GitHub advisory
- 2023-04-20: patched: v4.8.3 released with patch

## References

- [https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-93hq-5wgc-jc82](https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-93hq-5wgc-jc82)

## Related threats

- [OpenZeppelin Contracts information disclosure in VestingWalletConfidential](https://junglewise.ai/threats/openzeppelin-confidential-contracts-vestingwalletconfidential-a-14aa72cf)
- [OpenZeppelin Contracts out-of-bounds memory access in Bytes.lastIndexOf](https://junglewise.ai/threats/cve-2025-54070-openzeppelin-contracts-out-of-bounds-memory-access-in-bytes)
- [OpenZeppelin Contracts base64 encoding reads from dirty memory](https://junglewise.ai/threats/cve-2024-27094-openzeppelin-contracts-base64-encoding-reads-from-dirty-memory)
- [OpenZeppelin Contracts duplicated execution in Multicall](https://junglewise.ai/threats/cve-2023-49798-openzeppelin-contracts-duplicated-execution-in-multicall)
- [OpenZeppelin Contracts improper escaping in ERC2771Context](https://junglewise.ai/threats/cve-2023-40014-openzeppelin-contracts-improper-escaping-in-erc2771context)