PT-2023-23951 · Vyper · Vyper

Charles-Cooper + 1 · Published 2023-05-19 · Updated 2023-10-26 · CVE-2023-32675

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.3.8

Description In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This issue was fixed by the removal of the global calldatasize check.

Recommendations For versions prior to 0.3.8, upgrade to version 0.3.8. For users unable to upgrade, avoid use of nonpayable default functions.

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2023-32675

GHSA-VXMM-CWH2-Q762

PYSEC-2023-80

Affected Products

Vyper

References · 14

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-vxmm-cwh2-q762 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32675.json · Exploit
• https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-32675 · Security Note
• https://osv.dev/vulnerability/GHSA-vxmm-cwh2-q762 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32675 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-80 · Vendor Advisory
• https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520. · Note
• https://github.com/vyperlang/vyper · Note
• https://github.com/vyperlang/vyper/commit/903727006c1e5ebef99fa9fd5d51d62bd33d72a9 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-80.yaml · Note
• https://t.me/cibsecurity/64472 · Telegram Post
• https://t.me/cvenotify/50820 · Telegram Post
• https://t.me/cvenotify/51206 · Telegram Post