GovernorCompatibilityBravo may trim proposal calldata

Vulnerability

Description

CVE-2023-30542 is an input validation flaw in the GovernorCompatibilityBravo module of OpenZeppelin Contracts, a library for secure smart contract development. The propose function, which creates governance proposals, fails to enforce that the lengths of the signatures and calldatas arrays are equal [1]. This discrepancy arises because the internal logic iterates over the signatures array to build the final calldata, so when signatures is shorter, the extra elements in calldatas are simply ignored [3].

Attack

Surface and Exploitation

The issue can be triggered by submitting a proposal where the signatures array contains fewer entries than the calldatas array. The ProposalCreated event correctly reflects only the actions that will actually execute, which may mislead off-chain observers. However, when the proposal's actions are later queried via getActions, the returned parameters still show the originally intended calldata, creating a mismatch between what is expected and what executes [1]. An attacker could craft such a proposal, and if it passes governance, the extra actions would execute with no calldata, potentially altering contract state in unintended ways. No special authentication beyond the ability to propose is required, as the bug is in the proposal creation logic itself.

Impact

If a proposal with mismatched array lengths succeeds, the corresponding extra actions execute with an empty calldata. This could allow a malicious proposer to slip in hidden, no-argument function calls that were not visible in the governance review process, leading to arbitrary state changes or fund mismanagement. The severity is moderate (CVSS 5.3), as exploitation requires a proposal to pass governance.

Mitigation

The vulnerability was patched in OpenZeppelin Contracts version 4.8.3 [4]. The fix adds a require statement ensuring signatures.length == calldatas.length and adjusts the iteration loop to use the calldatas length [3]. Users on earlier versions are advised to upgrade. As a workaround, any governance system using GovernorCompatibilityBravo should manually validate that proposal parameters have equal-length arrays before submission [1].