PT-2025-4296 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions 0.2.0 through 0.4.0 Description: The Vyper Compiler has a vulnerability when using the precompiles EcRecover 0x1 and Identity 0x4, where the success flag of the call is not checked. This allows an attacker to provide a specific...

Vyper 安全漏洞

Vyper is a Pythonic smart contract language for EVM open sourced by vyperlang. A security vulnerability exists in Vyper 0.4.0 and earlier versions, which stems from the compiler failing to check the success flag of a call when using pre-compiled EcRecover and Identity, which could lead to incorre...

CVE-2024-43366 zkvyper ignored loop range bounds

zkvyper is a Vyper compiler. Starting in version 1.3.12 and prior to version 1.5.3, since LLL IR has no Turing-incompletness restrictions, it is compiled to a loop with a much more late exit condition. It leads to a loss of funds or other unwanted behavior if the loop body contains it. However,...

CVE-2024-43366 zkvyper ignored loop range bounds

zkvyper is a Vyper compiler. Starting in version 1.3.12 and prior to version 1.5.3, since LLL IR has no Turing-incompletness restrictions, it is compiled to a loop with a much more late exit condition. It leads to a loss of funds or other unwanted behavior if the loop body contains it. However,...

CVE-2024-43366 zkvyper ignored loop range bounds

zkvyper is a Vyper compiler. Starting in version 1.3.12 and prior to version 1.5.3, since LLL IR has no Turing-incompletness restrictions, it is compiled to a loop with a much more late exit condition. It leads to a loss of funds or other unwanted behavior if the loop body contains it. However,...

CVE-2024-43366

CVE-2024-43366 concerns the zkvyper Vyper compiler. From versions 1.3.12 up to 1.5.3, the LLL IR may be compiled into a loop with a late exit condition due to insufficient Turing-noncompleteness checks, potentially causing loss of funds or other unwanted behavior if the loop body contains it. Rea...

Vyper 安全漏洞

Vyper is the Pythonic smart contract language for EVM. Vyper has a security vulnerability that stems from the fact that LLL IR does not have a Turing incompleteness restriction, and therefore it is compiled as a loop with a later exit condition. If the loop body contains it, it can lead to loss o...

PT-2024-30529 · Zkvyper · Zkvyper

Name of the Vulnerable Software and Affected Versions: zkvyper versions 1.3.12 through 1.5.3 Description: The issue arises from the compilation of LLL IR to a loop with a late exit condition, potentially leading to a loss of funds or unwanted behavior if the loop body contains specific conditions...

SherlockChain - A Streamlined AI Analysis Framework For Solidity, Vyper And Plutus Contracts

SherlockChain is a powerful smart contract analysis framework that combines the capabilities of the renowned Slither tool with advanced AI-powered features. Developed by a team of security experts and AI researchers, SherlockChain offers unparalleled insights and vulnerability detection for...

Double Evaluation

vyper is vulnerable to a Double Evaluation. This vulnerability is due to the buildcreateIR function of the createfromblueprint builtin not caching the args argument, allowing for multiple evaluations instead of retrieving the value from the stack...

Double Evaluation

vyper is vulnerable to Double Evaluation. The vulnerability is due to the buildIR function of the sqrt builtin not caching the argument to the stack, allowing for multiple evaluations when the argument has side-effects...

Improper Input Validation

vyper is vulnerable to Improper Input Validation. The vulnerability is due to using the slice builtin with msg.data, self.code, or .code as the buffer argument, when either the start or length arguments have side-effects, allowing an attacker to manipulate the smart contract's behaviour or extrac...

Improper Locking

vyper is vulnerable to Improper Locking. This vulnerability is due to lack of reentrancy protection in default functions and not respecting nonreentrancy keys and failing to emit the lock, which allows an attacker to bypass the intended security mechanisms...

Range-Based Loop Execution

vyper is vulnerable to Range-Based Loop Execution. The vulnerability is due to incorrect assertion handling in the code generation of the range statement stmt.parseForrange within file stmt.py, which allows attackers to manipulate loop parameters...

Improper Input Validation

vyper is vulnerable to Improper Input Validation. The vulnerability is caused by improper handling of memory or storage arguments in the rawlog builtin, which results in incorrect values being logged when these arguments are used as topics...

vyper's range(start, start + N) reverts for negative numbers

Summary When looping over a range of the form rangestart, start + N, if start is negative, the execution will always revert. Details This issue is caused by an incorrect assertion inserted by the code generation of the range stmt.parseForrange:...

GHSA-PPX5-Q359-PVWJ vyper's range(start, start + N) reverts for negative numbers

Summary When looping over a range of the form rangestart, start + N, if start is negative, the execution will always revert. Details This issue is caused by an incorrect assertion inserted by the code generation of the range stmt.parseForrange:...

vyper performs incorrect topic logging in raw_log

Summary Incorrect values can be logged when rawlog builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in production. In particular, no uses of rawlog were found at all in production; it is apparently not ...

GHSA-XCHQ-W5R3-4WG3 vyper performs incorrect topic logging in raw_log

Summary Incorrect values can be logged when rawlog builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in production. In particular, no uses of rawlog were found at all in production; it is apparently not ...

vyper performs double eval of the slice start/length args in certain cases

Summary Using the slice builtin can result in a double eval vulnerability when the buffer argument is either msg.data, self.code or .code and either the start or length arguments have side-effects. A contract search was performed and no vulnerable contracts were found in production. Having...