PT-2024-30529 · Zkvyper · Zkvyper

Trocher · Published 2024-08-15 · Updated 2024-09-27 · CVE-2024-43366

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions zkvyper versions 1.3.12 through 1.5.3

Description The issue arises from the compilation of LLL IR to a loop with a late exit condition, potentially leading to a loss of funds or unwanted behavior if the loop body contains specific conditions. However, common use cases like iterating over an array are not affected. No contracts were reportedly affected by this issue.

Recommendations For versions 1.3.12 through 1.5.3, upgrade and redeploy affected contracts to avoid the issue. At the moment, there is no information about other versions that may require different actions.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2024-43366

GHSA-8J77-7RRV-6PXX

Affected Products

Zkvyper

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43366.json · Exploit
• 🔥 https://github.com/matter-labs/era-compiler-vyper/security/advisories/GHSA-8j77-7rrv-6pxx · Exploit
• https://osv.dev/vulnerability/CVE-2024-43366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43366 · Security Note
• https://twitter.com/CVEnew/status/1824181626319827138 · Twitter Post
• https://t.me/cvenotify/96399 · Telegram Post
• https://t.me/cvedetector/3291 · Telegram Post