OpenZeppelin/openzeppelin-contracts

Prevent proposals with duplicate actions from being submitted in `GovernorTimelockCompound`

Open

#6431 opened on Mar 23, 2026

View on GitHub
 (2 comments) (0 reactions) (1 assignee)JavaScript (23,941 stars) (11,560 forks)batch import
good first issue

Description

It is a know issue in Compound Governance that proposal queueing will fail if it contains 2 (or more) actions that have the same target, value, and calldata. While this can be circumvented by adding extra (useless) bytes at the end of the calldata to create unicity, it is possible to create such a proposal and not realised if will never be executable after the voting ends.

We should modify the behavior of _propose in GovernorTimelockCompound to reject proposals that have duplicated actions

Contributor guide

Tech stack
None
Domain
blockchainsecurity
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
blocked
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Solidity basicsOpenZeppelin ContractsCompound governance pattern
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30
Research direction
Examine the GovernorTimelockCompound contract (likely in contracts/governance/extensions/GovernorTimelockCompound.sol). The propose function should be modified to check for duplicate actions before adding them. Duplicate actions are defined as having the same target, value, and calldata. Consult the OpenZeppelin governance documentation and existing tests for guidance.