PYSEC-2023-131

    Dashboard / Vulnerabilities / PYSEC-2023-131

    PYSEC-2023-131

    Published: 24 Apr 2023Last Modified: 8 Nov 2023

    Summary:

    Details: Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the `raw_call` with `revert_on_failure=False` and `max_outsize=0` receives the wrong response from `raw_call`. Depending on the memory garbage, the result can be either `True` or `False`. A patch is available and, as of time of publication, anticipated to be part of Vyper 0.3.8. As a workaround, one may always put `max_outsize>0`.

    References: https://docs.vyperlang.org/en/v0.3.7/built-in-functions.html#raw_call, https://github.com/lidofinance/gate-seals/pull/5/files, https://github.com/lidofinance/gate-seals/blob/051593e74df01a4131c485b4fda52e691cd4b7d8/contracts/GateSeal.vy#L164, https://github.com/vyperlang/vyper/security/advisories/GHSA-w9g2-3w7p-72g9, https://github.com/vyperlang/vyper/commit/851f7a1b3aa2a36fd041e3d0ed38f9355a58c8ae

    Affected packages

    Package

    Name: vyper

    Purl: pkg:pypi/vyper

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -851f7a1b3aa2a36fd041e3d0ed38f9355a58c8ae

    Affected versions

    0.3.1
    0.3.2
    0.3.3
    0.3.4
    0.3.5
    0.3.6
    0.3.7

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2023-131 | CVE-DB