PT-2023-23571 · Vyper · Vyper
Trocher
·
Published
2023-05-11
·
Updated
2025-01-24
·
CVE-2023-32058
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Vyper versions prior to 0.3.8
Description
The issue is due to a missing overflow check for loop variables in Vyper, a Pythonic smart contract language for the Ethereum virtual machine. By assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. This issue seems to happen only in loops of type
for i in range(a, a + N), as the compiler can raise a TypeMismatch when trying to overflow the variable in loops of type for i in range(start, stop) and for i in range(stop).Recommendations
For versions prior to 0.3.8, update to version 0.3.8 to resolve the issue. As a temporary workaround, consider avoiding the use of loops of type
for i in range(a, a + N) where the iterator is assigned to a variable, to minimize the risk of exploitation. Restrict access to vulnerable smart contracts to prevent potential overflows until the issue is resolved.Exploit
Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Vyper