CVE-2022-29255
published 2022-06-09CVE-2022-29255: Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
1.21%
64.9th percentile
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vyperlang | vyper | < 0.3.4 | 0.3.4 |
| vyperlang | vyper | >= 0 < 0.3.4 | 0.3.4 |
| vyperlang | vyper | >= 0 < 6b4d8ff185de071252feaa1c319712b2d6577f8d | 6b4d8ff185de071252feaa1c319712b2d6577f8d |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-29255: Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine
osv·2022-06-09
CVE-2022-29255 CVE-2022-29255: Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.
GHSA
Multiple evaluation of contract address in call in vyper
ghsa·2022-06-06
CVE-2022-29255 [HIGH] CWE-670 Multiple evaluation of contract address in call in vyper
Multiple evaluation of contract address in call in vyper
### Impact
when a calling an external contract with no return value, the contract address could be evaluated twice. this is usually only an efficiency problem, but if evaluation of the contract address has side effects, it could result in double evaluation of the side effects.
in the following example, `Foo(msg.sender).bar()` is the contract address for the following call (to `.foo()`), and could get evaluated twice
```vyper
interface Foo:
def foo(): nonpayable
def bar() -> address: nonpayable
@external
def do_stuff():
Foo(Foo(msg.sender).bar()).foo()
```
### Patches
6b4d8ff185de071252feaa1c319712b2d6577f8d
### Workarounds
assign contract addresses to variables. the above example would change to
```vyper
@external
def do_stuff(
OSV
Multiple evaluation of contract address in call in vyper
osv·2022-06-06
CVE-2022-29255 [HIGH] Multiple evaluation of contract address in call in vyper
Multiple evaluation of contract address in call in vyper
### Impact
when a calling an external contract with no return value, the contract address could be evaluated twice. this is usually only an efficiency problem, but if evaluation of the contract address has side effects, it could result in double evaluation of the side effects.
in the following example, `Foo(msg.sender).bar()` is the contract address for the following call (to `.foo()`), and could get evaluated twice
```vyper
interface Foo:
def foo(): nonpayable
def bar() -> address: nonpayable
@external
def do_stuff():
Foo(Foo(msg.sender).bar()).foo()
```
### Patches
6b4d8ff185de071252feaa1c319712b2d6577f8d
### Workarounds
assign contract addresses to variables. the above example would change to
```vyper
@external
def do_stuff(
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/vyperlang/vyper/commit/6b4d8ff185de071252feaa1c319712b2d6577f8dhttps://github.com/vyperlang/vyper/security/advisories/GHSA-4v9q-cgpw-cf38https://github.com/vyperlang/vyper/commit/6b4d8ff185de071252feaa1c319712b2d6577f8dhttps://github.com/vyperlang/vyper/security/advisories/GHSA-4v9q-cgpw-cf38
2022-06-09
Published