| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| contracts | ≥ 4.3.0, < 4.9.1 | 4.9.1 |
| contracts upgradeable | ≥ 4.3.0, < 4.9.1 | 4.9.1 |
| @openzeppelin/contracts | ≥ 4.3.0, < 4.9.1 | 4.9.1 |
| @openzeppelin/contracts-upgradeable | ≥ 4.3.0, < 4.9.1 | 4.9.1 |
By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all.
This impacts the Governor contract in v4.9.0 only, and the GovernorCompatibilityBravo contract since v4.3.0.
The problem has been patched in 4.9.1 by introducing opt-in frontrunning protection.
Submit the proposal creation transaction to an endpoint with frontrunning protection.
Reported by Lior Abadi and Joaquin Pereyra from Coinspect.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン