5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
5.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.1%
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically: a .vy
contract compiled with vyper
versions 0.2.15
, 0.2.16
, or 0.3.0
; a primary function that utilizes the @nonreentrant
decorator with a specific key
and does not strictly follow the check-effects-interaction pattern (i.e. contains an external call to an untrusted party before storage updates); and a secondary function that utilizes the same key
and would be affected by the improper state caused by the primary function. Version 0.3.1 contains a fix for this issue.
[
{
"vendor": "vyperlang",
"product": "vyper",
"versions": [
{
"version": "= 0.2.15",
"status": "affected"
},
{
"version": "= 0.2.16",
"status": "affected"
},
{
"version": "= 0.3.0",
"status": "affected"
}
]
}
]
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
5.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.1%