CVE-2023-40015: falha de baixa gravidade em vyperlang vyper
Vyper: reversed order of side effects for some operations
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.7epss 0.5%
Vyper is a Pythonic Smart Contract Language. For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right to left instead of left to right. `unsafe_add, unsafe_sub, unsafe_mul, unsafe_div, pow_mod256, |, &, ^ (bitwise operators), bitwise_or (deprecated), bitwise_and (deprecated), bitwise_xor (deprecated), raw_call, <, >, <=, >=, ==, !=, in, not in (when lhs and rhs are enums)`. This behaviour becomes a problem when the evaluation of one of the arguments produces side effects that other arguments depend on. The following expressions can produce side-effect: state modifying external call , state modifying internal call, `raw_call`, `pop()` when used on a Dynamic Array stored in the storage, `create_minimal_proxy_to`, `create_copy_of`, `create_from_blueprint`. This issue has not yet been patched. Users are advised to make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
vyperlang · vyperCVEs relacionadas — vyperlang vyper
No mesmo produto, das mais perigosas para as menos.
CVE-2024-24563CRITICALVyper array negative index vulnerabilityEPSS 1.5%CVE-2022-24845HIGHInteger bounds error in VyperEPSS 1.4%CVE-2022-29255HIGHMultiple evaluation of contract address in call in vyperEPSS 1.3%CVE-2023-31146HIGHVyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignmentEPSS 1.3%CVE-2021-41121HIGHMemory corruption in VyperEPSS 1.1%CVE-2022-24787HIGHIncorrect Comparison in VyperEPSS 1.0%