CVE-2023-32675
published 2023-05-19CVE-2023-32675: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.55%
42.3th percentile
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the removal of the global `calldatasize` check in commit `02339dfda`. Users are advised to upgrade to version 0.3.8. Users unable to upgrade should avoid use of nonpayable default functions.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vyperlang | vyper | < 0.3.8 | 0.3.8 |
| vyperlang | vyper | >= 0 < 0.3.8 | 0.3.8 |
| vyperlang | vyper | >= 0 < 02339dfda0f3caabad142060d511d10bfe93c520. | 02339dfda0f3caabad142060d511d10bfe93c520. |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Vyper's nonpayable default functions are sometimes payable
osv·2023-05-22
CVE-2023-32675 [MEDIUM] Vyper's nonpayable default functions are sometimes payable
Vyper's nonpayable default functions are sometimes payable
### Impact
in contracts with at least one regular nonpayable function, due to the callvalue check being inside of the selector section, it is possible to send funds to the default function by using less than 4 bytes of calldata, even if the default function is marked `nonpayable`. this applies to contracts compiled with vyper uint256:
return 1
# implicitly nonpayable
@external
def __default__():
# could receive ether here
pass
```
### Patches
this was fixed by the removal of the global calldatasize check in https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520.
### Workarounds
don't use nonpayable default functions
GHSA
Vyper's nonpayable default functions are sometimes payable
ghsa·2023-05-22
CVE-2023-32675 [MEDIUM] CWE-670 Vyper's nonpayable default functions are sometimes payable
Vyper's nonpayable default functions are sometimes payable
### Impact
in contracts with at least one regular nonpayable function, due to the callvalue check being inside of the selector section, it is possible to send funds to the default function by using less than 4 bytes of calldata, even if the default function is marked `nonpayable`. this applies to contracts compiled with vyper uint256:
return 1
# implicitly nonpayable
@external
def __default__():
# could receive ether here
pass
```
### Patches
this was fixed by the removal of the global calldatasize check in https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520.
### Workarounds
don't use nonpayable default functions
OSV
CVE-2023-32675: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
osv·2023-05-19
CVE-2023-32675 CVE-2023-32675: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the removal of the global `calldatasize` check in commit `02339dfda`. Users are advised to upgrade to version 0.3.8. Users unable to upgrade should avoid use of nonpayable default functions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520https://github.com/vyperlang/vyper/security/advisories/GHSA-vxmm-cwh2-q762https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520https://github.com/vyperlang/vyper/security/advisories/GHSA-vxmm-cwh2-q762
2023-05-19
Published