PT-2023-22826 · Vyper · Vyper

Algys + 1 · Publicado 2023-04-24 · Atualizado 2023-08-02 · CVE-2023-30629

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vyper versions 0.3.1 through 0.3.7

Description The Vyper compiler generates the wrong bytecode in versions 0.3.1 through 0.3.7. Any contract that uses the raw call with revert on failure=False and max outsize=0 receives the wrong response from raw call. Depending on the memory garbage, the result can be either True or False.

Recommendations For Vyper versions 0.3.1 through 0.3.7, as a temporary workaround, consider always putting max outsize>0 to avoid the issue. A patch is anticipated to be part of Vyper 0.3.8.

Exploit

Correção

Enumeração de Fraquezas

CWE-670

Identificadores relacionados

CVE-2023-30629

GHSA-W9G2-3W7P-72G9

PYSEC-2023-131

Produtos afetados

Vyper

Referências · 14

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-w9g2-3w7p-72g9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30629.json · Exploit
• https://github.com/vyperlang/vyper/commit/851f7a1b3aa2a36fd041e3d0ed38f9355a58c8ae · Correção
• https://github.com/vyperlang/vyper · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-131.yaml · Nota
• https://github.com/lidofinance/gate-seals/pull/5/files · Correção
• https://github.com/lidofinance/gate-seals/blob/051593e74df01a4131c485b4fda52e691cd4b7d8/contracts/GateSeal.vy#L164 · Nota
• https://osv.dev/vulnerability/CVE-2023-30629 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-30629 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-w9g2-3w7p-72g9 · Aviso do Fabricante
• https://docs.vyperlang.org/en/v0.3.7/built-in-functions.html#raw_call · Nota
• https://t.me/cibsecurity/62783 · Publicação no Telegram
• https://osv.dev/vulnerability/PYSEC-2023-131 · Aviso do Fabricante
• https://t.me/cvenotify/49014 · Publicação no Telegram