PYSEC-2023-167

Vyper is a Pythonic Smart Contract Language. For the following probably non-exhaustive list of expressions, the compiler evaluates the arguments from right to left instead of left to right. unsafeadd, unsafesub, unsafemul, unsafediv, powmod256, |, &, ^ bitwise operators, bitwiseor deprecated,...

CVE-2023-40015 Vyper: reversed order of side effects for some operations

Vyper is a Pythonic Smart Contract Language. For the following probably non-exhaustive list of expressions, the compiler evaluates the arguments from right to left instead of left to right. unsafeadd, unsafesub, unsafemul, unsafediv, powmod256, |, &, ^ bitwise operators, bitwiseor deprecated,...

CVE-2023-40015 Vyper: reversed order of side effects for some operations

Vyper is a Pythonic Smart Contract Language. For the following probably non-exhaustive list of expressions, the compiler evaluates the arguments from right to left instead of left to right. unsafeadd, unsafesub, unsafemul, unsafediv, powmod256, |, &, ^ bitwise operators, bitwiseor deprecated,...

CVE-2023-40015

Vyper CVE-2023-40015 describes a compiler behavior issue where the argument evaluation order for a set of expressions is from right to left instead of left to right. The affected language constructs include unsafe_add, unsafe_sub, unsafe_mul, unsafe_div, pow_mod256, bitwise operators (|, &, ^, an...

CVE-2023-41052 Vyper: incorrect order of evaluation of side effects for some builtins

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions uint256addmod, uint256mulmod, ecadd and ecmul does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side...

CVE-2023-41052 Vyper: incorrect order of evaluation of side effects for some builtins

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions uint256addmod, uint256mulmod, ecadd and ecmul does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side...

CVE-2023-41052

Vyper CVE-2023-41052 affects the Pythonic smart contract language Vyper. In affected versions, the evaluation order of arguments to builtins uint256_addmod, uint256_mulmod, ecadd, and ecmul does not follow source order, which can cause side effects in one argument to be relied upon by others. The...

CVE-2023-41052 Vyper: incorrect order of evaluation of side effects for some builtins

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions uint256addmod, uint256mulmod, ecadd and ecmul does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side...

CVE-2023-40015: Always-Incorrect Control Flow Implementation

Vyper is a Pythonic Smart Contract Language. For the following probably non-exhaustive list of expressions, the compiler evaluates the arguments from right to left instead of left to right. unsafeadd, unsafesub, unsafemul, unsafediv, powmod256, |, &, ^ bitwise operators, bitwiseor deprecated,...

Lack of balance checks in the withdrawGivenOutputAmount function

Lines of code Vulnerability details Impact Lack of balance checks in the withdrawGivenOutputAmount function can lead to various unpredictable consequences due to the breach of requirements "The pool's balances of the x reserve and y reserve tokens must be greater than the MINBALANCE" and "The...

Existing checks with INT_MAX are insufficient such that the contract becomes dysfunctional after initial deployment of some large balance(s)

Lines of code Vulnerability details Impact EvolvingProteus.sol contains a variety of functions which detail the price in tokens to be paid in swaps, withdraws, and deposits. In external functions such as depositGivenInputAmount, as well as internal functions such as checkBalances, there exists a...

Max Price Ratio Manipulation

Lines of code Vulnerability details Impact Vulnerable Part in Code: pyinit.divpyinit.subpxinit ABDKMath64x64.divuuintMAXPRICERATIO, 1 here is A scenario where the range of acceptable price ratios is between 1 and 100 for instance, due to a misconfiguration or oversight, the constant MAXPRICERATIO...

Condition will not revert when block.timestamp is == to the compared variable

Lines of code Vulnerability details Medium Issues | | Issue | Instances ---|---|--- M-1 | Condition will not revert when block.timestamp is == to the compared variable | 1 M-1 Condition will not revert when block.timestamp is == to the compared variable The condition does not revert when...

Swaps affect LP token mint/burn during liquidity addition/removal

Lines of code Vulnerability details Impact The LP token removal/addition forces a recalculation of the bonding curve, and the utility of the curve. The utility curve in proteus looks like the graph below, where the point A represents a certain composition of the pool. If we try to remove add/remo...

Lack of events in EvolvingProteus contract

Lines of code Vulnerability details Impact There is no event emitted in the whole contract, even after executing sensitive actions like swaps between assets or at the constructor. That is bad because many automatic tools that monitors the contracts deployed rely on them. For example, see the swap...

Vulnerability in swapGivenInputAmount Function that could Leads to Unintended Token Draining

Lines of code Vulnerability details Impact The vulnerability discovered in the swapGivenInputAmount function has the potential to cause unintended token draining in the smart contract. Due to an incorrect check for a negative result in the code requireresult 0;, the function may allow swaps to...

Malicious code in platon-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 22347eb604c2a9b522547d6197c65f032cdeb71d4a38c8777a866fb3271869da The OpenSSF Package Analysis project identified 'platon-contract' @ 50.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1568 Malicious code in platon-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 22347eb604c2a9b522547d6197c65f032cdeb71d4a38c8777a866fb3271869da The OpenSSF Package Analysis project identified 'platon-contract' @ 50.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in hardhat-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3593917b9125465c1d3c5d6b38c62a9819d7590aea1522bdcf400ffef560a9b7 The OpenSSF Package Analysis project identified 'hardhat-contract' @ 15.0.0 npm as malicious. It is considered malicious because: - The package...

M-02 - Malicious users can set their hooks to contracts that will always revert, causing Claimers to get their tx to claim the user's prizes to be reverted

Lines of code Vulnerability details Title M-02 - Malicious users can set their hooks to contracts that will always revert, causing Claimers to get their tx to claim the user's prizes to be reverted Original Issue M-02 - Unintended or Malicious Use of Prize Winners' Hooks Details The previous...