vyper 0.4.2: известные уязвимости

Не удалось сравнить 16 записей. Результаты неполные.

1. CVE-2025-21607

   Низкий · CVSS 2.3EPSS 0,67%Нет опубликованного исправления

   Success of Certain Precompile Calls not Checked in Vyper

   Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be incorrect. Based on EVM's rules, after the failed precompile the remaining code has only 1/64 of the pre-call-gas left (as 63/64 were forwarded and spent). Hence, only fairly simple executions can follow the failed precompile calls. Therefore, we found no significantly impacted real-world contracts. No

   vyperPython

   Опубликовано 14 января 2025Обновлено 24 апреля 2025

   Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

2. CVE-2023-40015

   Низкий · CVSS 3.7EPSS 0,49%Нет опубликованного исправления

   Vyper: reversed order of side effects for some operations

   Vyper is a Pythonic Smart Contract Language. For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right to left instead of left to right. `unsafe_add, unsafe_sub, unsafe_mul, unsafe_div, pow_mod256, |, &, ^ (bitwise operators), bitwise_or (deprecated), bitwise_and (deprecated), bitwise_xor (deprecated), raw_call, <, >, <=, >=, ==, !=, in, not in (when lhs and rhs are enums)`. This behaviour becomes a problem when the evaluation of one of the arguments produces side effects that other arguments depend on. The following expressions can produce side-effect: state modifying external call , sta

   vyperPython

   Опубликовано 4 сентября 2023Обновлено 19 ноября 2024

   Исходное сообщение 1 ↗Исходное сообщение 2 ↗

3. CVE-2023-39363

   Критический · CVSS 9.1EPSS 0,82%Нет опубликованного исправления

   Vyper incorrectly allocated named re-entrancy locks

   Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically: a `.vy` contract compiled with `vyper` versions `0.2.15`, `0.2.16`, or `0.3.0`; a primary function that utilizes the `@nonreentrant` decorator with a specific `key` and does not strictly follow the

   vyperPython

   Опубликовано 7 августа 2023Обновлено 11 октября 2024

   Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗