GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts

What the vulnerability is

The vulnerability exists in OpenZeppelin Contracts' Governor module when using GovernorVotesQuorumFraction, which computes quorum as a percentage of the voting token's total supply. If a governance proposal is passed that lowers the quorum requirement, past proposals that were previously defeated solely because they failed to meet the old quorum may become executable — as long as the number of votes they received meets the new, lower quorum threshold [1][4].

How it's exploited

An attacker (or even a well-intentioned but unaware proposer) could trigger this by passing a proposal that reduces the quorum fraction. No authentication bypass is needed; the exploit relies on the normal governance process. The attack surface is any Governor contract that uses GovernorVotesQuorumFraction and has previously had proposals defeated for lack of quorum. The vulnerability is that the system does not keep a historical record of quorum values at the time each proposal was considered, so reducing quorum retroactively grants passage for old proposals [3][4].

Impact

An attacker could gain the ability to execute previously defeated proposals, which might include actions like transferring funds, changing contract parameters, or other sensitive operations. OpenZeppelin's on-chain analysis found only one proposal that met this condition, but the impact could be severe in-specific contexts [1][4].

Mitigation

The issue has been patched in version v4.7.2, which now tracks historical quorum values to prevent retroactive passage [3][4]. Users are advised to upgrade. For those unable to upgrade immediately, the workaround is to avoid lowering quorum requirements if any past proposal was defeated for lack of quorum [1][4].