CVE-2023-30542

OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata. This issue has been patched in 4.8.3. As a workaround, ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.

• CWE-20

• https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.8.3Release Notes
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-93hq-5wgc-jc82Vendor Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.8.3Release Notes
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-93hq-5wgc-jc82Vendor Advisory

Published

Apr 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30536slim/psr7 is a PSR-7 implementation for use with Slim 4. In …6.5
• CVE-2023-30537XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-30538Discourse is an open source platform for community discussio…5.4
• CVE-2023-30539Nextcloud is a personal home server system. Depending on the…8.8
• CVE-2023-30540Nextcloud Talk is a chat, video & audio call extension for N…4.3
• CVE-2023-30541OpenZeppelin Contracts is a library for secure smart contrac…5.3
• CVE-2023-30543@web3-react is a framework for building Ethereum Apps . In a…5.7
• CVE-2023-30544Kiwi TCMS is an open source test management system. In versi…4.3
• CVE-2023-30545PrestaShop is an Open Source e-commerce web application. Pri…6.5
• CVE-2023-30546Contiki-NG is an operating system for Internet of Things dev…7.5
• CVE-2023-30547vm2 is a sandbox that can run untrusted code with whiteliste…10
• CVE-2023-30548gatsby-plugin-sharp is a plugin for the gatsby framework whi…4.3