OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning (CVE-2023-34234)

OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning (CVE-2023-34234) | HOL Guard CVE

Why this deserves its current priority

CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
@openzeppelin/contractsnpm	>=4.3.0 <4.9.1	4.9.1
@openzeppelin/contracts-upgradeablenpm	>=4.3.0 <4.9.1	4.9.1

Recommended response

Check inventory. Check lockfiles and deployed manifests for @openzeppelin/contracts, @openzeppelin/contracts-upgradeable.
Review the reported fix. Update @openzeppelin/contracts to 4.9.1; @openzeppelin/contracts-upgradeable to 4.9.1 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jun 8, 2023
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

### Impact By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0. ### Patches The problem has been patched in 4.9.1 by introducing opt-in frontrunning protection. ### Workarounds Submit the proposal creation transaction to an endpoint with frontrunning protection. ### Credit Reported by Lior Abadi and Joaquin Pereyra from Coinspect. ### References https://www.coinspect.com/openzeppelin-governor-dos/

Quoted source text, attributed separately from HOL analysis.