{"id":"CVE-2023-30542","aliases":["EUVD-2023-1247","GHSA-93hq-5wgc-jc82"],"status":"published","title":"GovernorCompatibilityBravo may trim proposal calldata","description":"OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata. This issue has been patched in 4.8.3. As a workaround, ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00584,"percentile":0.48425,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2023-04-16T07:10:13Z","modified":"2026-10-28T02:30:23Z","fixes":[{"ecosystem":"npm","package":"@openzeppelin/contracts","fixed_in":["4.8.3"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@openzeppelin/contracts-upgradeable","fixed_in":["4.8.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@openzeppelin/contracts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.8.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@openzeppelin/contracts-upgradeable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.8.3"}]}]},{"source":"osv","ecosystem":"npm","package":"@openzeppelin/contracts","ranges":[{"type":"SEMVER","events":[{"introduced":"4.3.0"},{"fixed":"4.8.3"}]}]},{"source":"osv","ecosystem":"npm","package":"@openzeppelin/contracts-upgradeable","ranges":[{"type":"SEMVER","events":[{"introduced":"4.3.0"},{"fixed":"4.8.3"}]}]}],"products":[{"vendor":"openzeppelin","product":"contracts"},{"vendor":"openzeppelin","product":"contracts_upgradeable"},{"vendor":"openzeppelin","product":"openzeppelin-contracts"}],"references":[{"url":"https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-93hq-5wgc-jc82","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.8.3","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30542","tags":["advisory"]},{"url":"https://github.com/OpenZeppelin/openzeppelin-contracts/commit/8d633cb7d169f2f8595b273660b00b69e845c2fe","tags":["web"]},{"url":"https://github.com/advisories/GHSA-93hq-5wgc-jc82"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30542.json","tags":["advisory"]},{"url":"https://github.com/OpenZeppelin/openzeppelin-contracts","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-30542","title":"GovernorCompatibilityBravo may trim proposal calldata","description":"OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata. This issue has been patched in 4.8.3. As a workaround, ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.","status":"published","published":"2023-04-16T07:10:13.474Z","modified":"2025-02-06T16:05:37.183Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:22.309324Z"}],"euvd":[{"id":"EUVD-2023-1247","description":"OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata. This issue has been patched in 4.8.3. As a workaround, ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.","status":"published","published":"2023-04-16T07:10:13Z","modified":"2025-02-06T16:05:37Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:03.312509Z"}],"ghsa":[{"id":"GHSA-93hq-5wgc-jc82","title":"GovernorCompatibilityBravo may trim proposal calldata","description":"### Impact\n\nThe proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata.\n\n### Patches\n\nThis issue has been patched in v4.8.3.\n\n### Workarounds\n\nEnsure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.\n","status":"published","published":"2023-04-20T14:11:03Z","modified":"2023-04-27T15:35:35Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:51.39133Z"}],"nvd":[{"id":"CVE-2023-30542","description":"OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata. This issue has been patched in 4.8.3. As a workaround, ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.","status":"published","published":"2023-04-16T08:15:07.867Z","modified":"2026-06-17T05:54:59.057Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:55.652109Z"}],"osv":[{"id":"CVE-2023-30542","title":"GovernorCompatibilityBravo may trim proposal calldata","description":"OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata. This issue has been patched in 4.8.3. As a workaround, ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.","status":"published","published":"2023-04-16T07:10:13.474Z","modified":"2026-10-28T02:30:23.671794986Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"GHSA-93hq-5wgc-jc82","title":"GovernorCompatibilityBravo may trim proposal calldata","description":"### Impact\n\nThe proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata.\n\n### Patches\n\nThis issue has been patched in v4.8.3.\n\n### Workarounds\n\nEnsure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.\n","status":"published","published":"2023-04-20T14:11:03Z","modified":"2023-11-08T04:12:24.945774Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}