# CVE-2023-34234: OpenZeppelin Contracts Governor frontrunning proposal creation denial

Source: https://junglewise.ai/threats/cve-2023-34234-openzeppelin-contracts-governor-frontrunning-proposal-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-06-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-34234 · Severity: low · CVSS 3.1 · Published 2023-06-08

OpenZeppelin Contracts provides smart contract libraries used by blockchain projects to implement governance mechanisms. An attacker can exploit a frontrunning vulnerability in the Governor proposal creation process to repeatedly block legitimate proposals from being submitted to a blockchain network. By observing and front-running proposal transactions, an attacker can hijack the proposer role and cancel proposals, disrupting the governance process and potentially preventing important organizational decisions from being made.

Technologies: [@openzeppelin/contracts (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts), [@openzeppelin/contracts-upgradeable (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts-upgradeable), [OpenZeppelin Contracts](https://junglewise.ai/threats/technologies/contracts), [OpenZeppelin Contracts Upgradeable](https://junglewise.ai/threats/technologies/contracts-upgradeable). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [OpenZeppelin](https://junglewise.ai/threats/vendors/openzeppelin).

## Quick answers

**Is CVE-2023-34234 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-34234 being exploited in the wild.

**How severe is CVE-2023-34234?** Low severity, with a CVSS score of 3.1, published 8 June 2023.

**Which products and versions are affected?** @openzeppelin/contracts (npm) SEMVER:introduced=4.3.0,fixed=4.9.1; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.3.0,fixed=4.9.1; OpenZeppelin Contracts >=4.3.0, <4.9.1; OpenZeppelin Contracts Upgradeable >=4.3.0, <4.9.1.

**Is there a fix for CVE-2023-34234?** Yes. @openzeppelin/contracts (npm): upgrade to 4.9.1 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-34234 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-34234?** Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @openzeppelin/contracts (npm): upgrade to 4.9.1 or later

  ```sh
  npm install @openzeppelin/contracts@4.9.1
  ```

- @openzeppelin/contracts-upgradeable (npm): upgrade to 4.9.1 or later

  ```sh
  npm install @openzeppelin/contracts-upgradeable@4.9.1
  ```


## Technical details

The vulnerability is a frontrunning attack vector in the Governor contract's propose() function. An attacker monitoring the network can submit a conflicting proposal transaction with higher gas fees to execute before the legitimate proposal, becoming the proposer. Since only the proposer can cancel a proposal, the attacker can then immediately cancel it. By repeating this technique, an attacker can systematically prevent specific proposals from being created. The issue affects Governor v4.9.0 and GovernorCompatibilityBravo since v4.3.0. The attack requires network access to observe and submit transactions but no authentication. The fix, deployed in v4.9.1, introduces opt-in frontrunning protection via a suffix mechanism in the proposal description that restricts the proposer address, as documented in the _isValidDescriptionForProposer function.

## Affected products

- OpenZeppelin @openzeppelin/contracts >=4.3.0, <4.9.1
- OpenZeppelin @openzeppelin/contracts-upgradeable >=4.3.0, <4.9.1

## Identifiers

- CVE-2023-34234
- GHSA-5h3x-9wvq-w4m2

## Timeline

- 2023-06-07: disclosed: Vulnerability disclosed; published via GitHub Advisory GHSA-5h3x-9wvq-w4m2
- 2023-06-07: patched: Fixed in v4.9.1 with opt-in frontrunning protection mechanism

## References

- [https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-5h3x-9wvq-w4m2](https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-5h3x-9wvq-w4m2)
- [https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/66f390fa516b550838e2c2f65132b5bc2afe1ced](https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/66f390fa516b550838e2c2f65132b5bc2afe1ced)
- [https://github.com/OpenZeppelin/openzeppelin-contracts/commit/d9474327a492f9f310f31bc53f38dbea56ed9a57](https://github.com/OpenZeppelin/openzeppelin-contracts/commit/d9474327a492f9f310f31bc53f38dbea56ed9a57)
- [https://github.com/OpenZeppelin/openzeppelin-contracts](https://github.com/OpenZeppelin/openzeppelin-contracts)
- [https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.9.1](https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.9.1)

## Related threats

- [OpenZeppelin Contracts information disclosure in VestingWalletConfidential](https://junglewise.ai/threats/openzeppelin-confidential-contracts-vestingwalletconfidential-a-14aa72cf)
- [OpenZeppelin Contracts out-of-bounds memory access in Bytes.lastIndexOf](https://junglewise.ai/threats/cve-2025-54070-openzeppelin-contracts-out-of-bounds-memory-access-in-bytes)
- [OpenZeppelin Contracts base64 encoding reads from dirty memory](https://junglewise.ai/threats/cve-2024-27094-openzeppelin-contracts-base64-encoding-reads-from-dirty-memory)
- [OpenZeppelin Contracts duplicated execution in Multicall](https://junglewise.ai/threats/cve-2023-49798-openzeppelin-contracts-duplicated-execution-in-multicall)
- [OpenZeppelin Contracts improper escaping in ERC2771Context](https://junglewise.ai/threats/cve-2023-40014-openzeppelin-contracts-improper-escaping-in-erc2771context)