Skip to content

GHSA-g2xh-c426-v8mf CVE-2023-40015 PYSEC-2023-167

Vyper: reversed order of side effects for some operations

Medium PyPI
Severity
0.0 / 10
Medium · CVSS 4.0
Exploit chance (EPSS)
0.49%
Chance of exploitation in the next 30 days. Higher than 42.30% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-670 Always-Incorrect Control Flow Implementation
Fix
0.3.10rc1
Upgrade vyper to this version or later

Description

Impact

For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right to left instead of left to right.

- unsafe_add
- unsafe_sub
- unsafe_mul
- unsafe_div
- pow_mod256
- |, &, ^ (bitwise operators)
- bitwise_or (deprecated)
- bitwise_and (deprecated)
- bitwise_xor (deprecated)
- raw_call
- <, >, <=, >=, ==, !=
- in, not in (when lhs and rhs are enums)

This behaviour becomes a problem when the evaluation of one of the arguments produces side effects that other arguments depend on. The following expressions can produce side-effect:

  • state modifying external call
  • state modifying internal call
  • raw_call
  • pop() when used on a Dynamic Array stored in the storage
  • create_minimal_proxy_to
  • create_copy_of
  • create_from_blueprint

For example:

f:uint256

@internal
def side_effect() -> uint256:
    self.f = 12
    return 1

@external
def foo() -> uint256:
    return unsafe_add(self.f,self.side_effect()) # returns 13 instead of 1
a:DynArray[uint256, 12]
@external
def bar() -> bool:
    self.a = [1,2,3]
    return len(self.a) == self.a.pop() # return false instead of true

Patches

not yet patched, will address in a future release. tracking in https://github.com/vyperlang/vyper/issues/3604.

Workarounds

When using expressions from the list above, make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.

References

Are there any links users can visit to find out more?

Affected versions

PyPI

PackageVulnerableFixed in
vyper
<= 0.4.2
No fix yet
vyper
< 0.3.10rc1
0.3.10rc1

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

vyper PyPI → 0.3.10rc1

pip
pip install --upgrade "vyper>=0.3.10rc1"
poetry
poetry add "vyper>=0.3.10rc1"
uv
uv add "vyper>=0.3.10rc1"

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
None
Integrity (vulnerable system)
Low
Availability (vulnerable system)
None
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Weakness

CWE-670: Always-Incorrect Control Flow Implementation

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

References

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-2r3x-4mrv-mcxf
Vyper: Memory corruption using function calls within tuples / nested calls
Medium Also affects vyper
GHSA-4v7v-gqf9-ww2g
Vyper: Call stack corruption when passing complex type containing non-base type members as argument
Medium Also affects vyper
GHSA-vg88-3v92-rjx2
Vyper: Return inside for loop more than 1 level deep
Low Also affects vyper
GHSA-3vcg-j39x-cwfm
Vyper's `slice()` may elide side-effects when output length is 0
Low Also affects vyper
GHSA-qhr6-mgqr-mchm
Vyper's `concat()` builtin may elide side-effects for zero-length arguments
Low Also affects vyper
GHSA-h33q-mhmp-8p67
Vyper has a double eval in For List Iter
High Also affects vyper
GHSA-4w26-8p97-f4jp
AugAssign evaluation order causing OOB write within the object in Vyper
Critical Also affects vyper
GHSA-2p94-8669-xg86
Vyper's sqrt doesn't define rounding behavior
High Also affects vyper
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor