TI-2022-13238 Aliases CVE-2022-31198 GHSA-xrc4-737v-9q75

GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts

MEDIUM 40CWE-682Published 2022-08-01 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module `GovernorVotesQuorumFraction`, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a proposal is passed to lower the quorum requirements, past proposals may become executable if they had been defeated only due to lack of quorum, and the number of votes it received meets the new quorum requirement. Analysis of instances on chain found only one proposal that met this condition, and we are actively monitoring for new occurrences of this particular issue. This issue has been patched in v4.7.2. Users are advised to upgrade. Users unable to upgrade should consider avoiding lowering quorum requirements if a past proposal was defeated for lack of quorum.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00788 56th percentileScored 2026-11-07

Fix Fixed openzeppelin-contracts (OpenZeppelin): 4.7.2@openzeppelin/contracts (npm): 4.7.2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenZeppelin	openzeppelin-contracts	4.3.0 to before 4.7.2	4.7.2	Patch available	CNA
—	@openzeppelin/contracts (npm)	4.3.0 to before 4.7.2	4.7.2	Patch available	GHSA-xrc4-737v-9q75
—	@openzeppelin/contracts-upgradeable (npm)	4.3.0 to before 4.7.2	4.7.2	Patch available	GHSA-xrc4-737v-9q75

openzeppelin-contracts VendorOpenZeppelin Affected 4.3.0 to before 4.7.2 Fixed in 4.7.2 Patch available CNA
@openzeppelin/contracts (npm) Vendor— Affected 4.3.0 to before 4.7.2 Fixed in 4.7.2 Patch available GHSA-xrc4-737v-9q75
@openzeppelin/contracts-upgradeable (npm) Vendor— Affected 4.3.0 to before 4.7.2 Fixed in 4.7.2 Patch available GHSA-xrc4-737v-9q75

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:openzeppelin:contracts::::::node.js::*	4.3.0 to before 4.7.2	Vulnerable	OpenZeppelin
cpe:2.3:a:openzeppelin:contracts_upgradeable::::::node.js::*	4.3.0 to before 4.7.2	Vulnerable	OpenZeppelin

cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:* Versions 4.3.0 to before 4.7.2 Vulnerable ·OpenZeppelin
cpe:2.3:a:openzeppelin:contracts_upgradeable:*:*:*:*:*:node.js:*:* Versions 4.3.0 to before 4.7.2 Vulnerable ·OpenZeppelin

Remediation

Fix · CNA openzeppelin-contracts (OpenZeppelin) Fixed in 4.7.2
Fix · GHSA-xrc4-737v-9q75 @openzeppelin/contracts (npm) Fixed in 4.7.2 Advisory →
Fix · GHSA-xrc4-737v-9q75 @openzeppelin/contracts-upgradeable (npm) Fixed in 4.7.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-31198
2026-10-03 Alias added: GHSA-xrc4-737v-9q75

References

Patch 1

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3561

Advisory 2

Other 2

TI-2022-13196 OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli CVSS 3.1MEDIUM 6.5
TI-2021-16554 TimelockController vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 10.0
TI-2021-16553 TimelockController vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 10.0
TI-2021-18096 UUPSUpgradeable vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 9.8
TI-2022-13212 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false CVSS 3.1HIGH 7.5
TI-2023-14377 GovernorCompatibilityBravo may trim proposal calldata CVSS 3.1HIGH 8.8

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences