GHSA-m2v9-w374-5hj9 CVE-2024-32648 PYSEC-2024-163

vyper default functions don't respect nonreentrancy keys

Medium PyPI

Severity: 5.3 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 0.41%; Chance of exploitation in the next 30 days. Higher than 35.88% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-667 Improper Locking
Fix: 0.3.0; Upgrade vyper to this version or later

Description

Summary

Prior to v0.3.0, __default__() functions did not respect the @nonreentrancy decorator and the lock was not emitted. This is a known bug and was already visible in the issue tracker (https://github.com/vyperlang/vyper/issues/2455), but it is being re-issued as an advisory so that tools relying on the advisory publication list can incorporate it into their searches.

A contract search was additionally performed and no vulnerable contracts were found in production.

PoC

@external
@payable
@nonreentrant("default")
def __default__():
    pass

after codegen:

[seq,
  [if, [lt, calldatasize, 4], [goto, fallback]],
  [mstore, 28, [calldataload, 0]],
  [with, _func_sig, [mload, 0], seq],
  [seq_unchecked,
    [label, fallback],
    [seq,
      pass,
      # Line 5
      pass,
      pass,
      # Line 4
      stop]]],

Impact

No vulnerable production contracts were found. Additionally, using a lock on a default function is a very sparsely used pattern. As such, the impact is low.

Affected versions

PyPI

Package	Vulnerable	Fixed in
vyper	`< 0.3.0`	`0.3.0`
vyper	`< 0.3.0`	`0.3.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

vyper PyPI → `0.3.0`

pip

pip install --upgrade "vyper>=0.3.0"

poetry

poetry add "vyper>=0.3.0"

uv

uv add "vyper>=0.3.0"

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

Weakness

CWE-667: Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

How to prevent it

Implementation: Use industry standard APIs to implement locking mechanism.

References

Advisories

Packages

github.com/vyperlang/vyper

Timeline

Apr 25, 2024 Published
Jun 17, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-2r3x-4mrv-mcxf Vyper: Memory corruption using function calls within tuples / nested calls	Medium	Also affects vyper
GHSA-4v7v-gqf9-ww2g Vyper: Call stack corruption when passing complex type containing non-base type members as argument	Medium	Also affects vyper
GHSA-vg88-3v92-rjx2 Vyper: Return inside for loop more than 1 level deep	Low	Also affects vyper
GHSA-3vcg-j39x-cwfm Vyper's `slice()` may elide side-effects when output length is 0	Low	Also affects vyper
GHSA-qhr6-mgqr-mchm Vyper's `concat()` builtin may elide side-effects for zero-length arguments	Low	Also affects vyper
GHSA-h33q-mhmp-8p67 Vyper has a double eval in For List Iter	High	Also affects vyper
GHSA-4w26-8p97-f4jp AugAssign evaluation order causing OOB write within the object in Vyper	Critical	Also affects vyper
GHSA-2p94-8669-xg86 Vyper's sqrt doesn't define rounding behavior	High	Also affects vyper

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor