CVE-2024-38533mediumCWE-787

CVE-2024-38533: medium-severity vulnerability in matter-labs era-compiler-vyper

ZKsync Era invalid stack addressing conversion

Published · Updated

Follow this CVE+ Monitor era-compiler-vyper

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.3%
ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. There is possible invalid stack access due to the addresses used to access the stack not properly being converted to cells. This issue has been patched in version 1.5.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
matter-labs · era-compiler-vyper
Related CVEs — matter-labs era-compiler-vyper

In the same product, most dangerous first.

CVE-2023-46232MEDIUMera-compiler-vyper First Immutable Variable Initialization vulnerabilityEPSS 0.7%CVE-2024-43366HIGHzkvyper ignored loop range boundsEPSS 0.5%