PT-2022-19503 · Vyper · Vyper

Charles-Cooper · Published 2022-06-06 · Updated 2023-08-02 · CVE-2022-29255

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.3.4

Description The issue arises when calling an external contract with no return value, potentially resulting in the contract address being evaluated twice, including any side effects. This could lead to incorrect outcomes for contracts. The problem is usually an efficiency issue but can cause double evaluation of side effects if the contract address evaluation has side effects.

Recommendations For versions prior to 0.3.4, update to version 0.3.4 or later to resolve the issue. As a temporary workaround, consider assigning contract addresses to variables to avoid double evaluation of side effects. For example, instead of Foo(Foo(msg.sender).bar()).foo(), use t: Foo = Foo(msg.sender).bar() and then t.foo().

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2022-29255

GHSA-4V9Q-CGPW-CF38

PYSEC-2022-43053

Affected Products

Vyper

References · 11

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-4v9q-cgpw-cf38 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29255.json · Exploit
• https://github.com/vyperlang/vyper/commit/6b4d8ff185de071252feaa1c319712b2d6577f8d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29255 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-43053 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29255 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4v9q-cgpw-cf38 · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2022-43053.yaml · Note
• https://t.me/cvenotify/31342 · Telegram Post
• https://t.me/cibsecurity/44080 · Telegram Post