Summary
GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior
Workarounds
Do not create proposals using explicit function signatures. Instead, use the propose function without the signatures argument, and create the proposal using the fully ABI-encoded function call including the function selector in the calldatas argument as explained above.
References
https://github.com/OpenZeppelin/openzeppelin-contracts/issues/3099
Credits
This issue was identified and reported by @GeraldHost.
For more information
If you have any questions, comments, or need assistance regarding this advisory, email us at [email protected].
To submit security reports please use our bug bounty on Immunefi.
Impact
The GovernorCompatibilityBravo module may lead to the creation of governance proposals that execute function calls with incorrect arguments due to bad ABI encoding. This happens if the proposal is created using explicit function signatures, e.g. a proposal to invoke the function foo(uint256) is created as propose([target], [0], ["foo(uint256)"], ["0x00..01"]). If the function selector is provided as part of the encoded proposal data the issue is not present, e.g. the same proposal is created as propose([target], [0], ["0x2fbebd3800..01"]), where 2fbebd38 is the function selector.
We've assessed the instances of this contract found on chain, and did not find any occurrence of this bug in the past. Proposal creation through Tally or OpenZeppelin Defender is not affected. The core Governor contract on its own is not affected.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
A fix is included in version v4.4.2 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable.
Frequently Asked Questions
- What is GHSA-M6W8-FQ7V-PH4M? GHSA-M6W8-FQ7V-PH4M is a medium-severity security vulnerability in @openzeppelin/contracts (npm), affecting versions >= 4.3.0, < 4.4.2. It is fixed in 4.4.2.
- Which packages are affected by GHSA-M6W8-FQ7V-PH4M?
@openzeppelin/contracts(npm) (versions >= 4.3.0, < 4.4.2)@openzeppelin/contracts-upgradeable(npm) (versions >= 4.3.0, < 4.4.2)
- Is there a fix for GHSA-M6W8-FQ7V-PH4M? Yes. GHSA-M6W8-FQ7V-PH4M is fixed in 4.4.2. Upgrade to this version or later.
- Is GHSA-M6W8-FQ7V-PH4M exploitable, and should I be worried? Whether GHSA-M6W8-FQ7V-PH4M is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-M6W8-FQ7V-PH4M is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-M6W8-FQ7V-PH4M?
- Upgrade
@openzeppelin/contractsto 4.4.2 or later - Upgrade
@openzeppelin/contracts-upgradeableto 4.4.2 or later
- Upgrade