PT-2023-22826 · Vyper · Vyper

Algys + 1 · Published 2023-04-24 · Updated 2023-08-02 · CVE-2023-30629

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vyper versions 0.3.1 through 0.3.7

Description The Vyper compiler generates the wrong bytecode in versions 0.3.1 through 0.3.7. Any contract that uses the raw call with revert on failure=False and max outsize=0 receives the wrong response from raw call. Depending on the memory garbage, the result can be either True or False.

Recommendations For Vyper versions 0.3.1 through 0.3.7, as a temporary workaround, consider always putting max outsize>0 to avoid the issue. A patch is anticipated to be part of Vyper 0.3.8.

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2023-30629

GHSA-W9G2-3W7P-72G9

PYSEC-2023-131

Affected Products

Vyper

References · 14

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-w9g2-3w7p-72g9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30629.json · Exploit
• https://github.com/vyperlang/vyper/commit/851f7a1b3aa2a36fd041e3d0ed38f9355a58c8ae · Patch
• https://github.com/lidofinance/gate-seals/pull/5/files · Patch
• https://osv.dev/vulnerability/CVE-2023-30629 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30629 · Security Note
• https://osv.dev/vulnerability/GHSA-w9g2-3w7p-72g9 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-131 · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-131.yaml · Note
• https://github.com/lidofinance/gate-seals/blob/051593e74df01a4131c485b4fda52e691cd4b7d8/contracts/GateSeal.vy#L164 · Note
• https://docs.vyperlang.org/en/v0.3.7/built-in-functions.html#raw_call · Note
• https://t.me/cibsecurity/62783 · Telegram Post
• https://t.me/cvenotify/49014 · Telegram Post