CVE-2023-37902 Vyper's ecrecover can return undefined data if signature does not verify

Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine EVM. Prior to version 0.3.10, the ecrecover precompile does not fill the output buffer if the signature does not verify. However, the ecrecover builtin will still return whatever is at memory location 0. This means...

CVE-2023-37902 Vyper's ecrecover can return undefined data if signature does not verify

Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine EVM. Prior to version 0.3.10, the ecrecover precompile does not fill the output buffer if the signature does not verify. However, the ecrecover builtin will still return whatever is at memory location 0. This means...

CVE-2023-37902

Vyper (Pythonic language for the EVM) has a vulnerability in the ecrecover precompile prior to version 0.3.10, where the output buffer may contain undefined data if a signature does not verify. The ecrecover builtin can still return memory contents at address 0, potentially causing a signature ch...

PT-2023-26172 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions prior to 0.3.10 Description: The ecrecover precompile in Vyper does not fill the output buffer if the signature does not verify. However, the ecrecover builtin will still return whatever is at memory location 0. This means that...

Vyper 安全漏洞

Vyper is the Pythonic smart contract language for EVM. A security vulnerability exists in Vyper versions prior to 0.3.10 that stems from allowing ecrecover to return undefined data for invalid signatures...

Loss Of Funds

vyper is vulnerable to Loss of Funds. The vulnerability is due to the call value check being called inside the selector section, which makes it possible to send funds to a non-payable default function by using less then 4 bytes of call data. This can result in the loss of funds...

GHSA-VXMM-CWH2-Q762 Vyper's nonpayable default functions are sometimes payable

Impact in contracts with at least one regular nonpayable function, due to the callvalue check being inside of the selector section, it is possible to send funds to the default function by using less than 4 bytes of calldata, even if the default function is marked nonpayable. this applies to...

Vyper's nonpayable default functions are sometimes payable

Impact in contracts with at least one regular nonpayable function, due to the callvalue check being inside of the selector section, it is possible to send funds to the default function by using less than 4 bytes of calldata, even if the default function is marked nonpayable. this applies to...

CVE-2023-32675

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This applies to contracts compiled with vyper version...

PYSEC-2023-80

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This applies to contracts compiled with vyper version...

PYSEC-2023-80

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This applies to contracts compiled with vyper version...

CVE-2023-32675

CVE-2023-32675 affects Vyper prior to 0.3.8. In contracts with more than one regular nonpayable function, funds could be sent to the default function even if it is nonpayable due to an early calldatasize check, as described in public advisories. The issue was fixed by removing the global calldata...

CVE-2023-32675 Nonpayable default functions are sometimes payable in vyper

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This applies to contracts compiled with vyper version...

CVE-2023-32675 Nonpayable default functions are sometimes payable in vyper

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This applies to contracts compiled with vyper version...

CVE-2023-32675 Nonpayable default functions are sometimes payable in vyper

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This applies to contracts compiled with vyper version...

Denial Of Services (DoS)

vyper is vulnerable to Denial Of Services DoS. The vulnerability exists due to an integer overflow in the parseForrange function of stmt.py for loops of the form for i in rangex, x+N, which results in an application crash by assigning the iterator of a loop to a variable...

Improper Access Control

vyper is vulnerable to Improper Access Control. If the length word of a dynarray is on both the left-hand side and the right-hand side of an assignment, it may result in out-of-bounds array access, resulting in call frame data corruption...

Vyper 安全漏洞

Vyper is the Pythonic smart contract language for EVM. A security vulnerability exists in versions of Vyper prior to 0.3.8 that stems from the ability to send funds to a default function in a contract with multiple regular non-payable functions, even if the default function is marked as non-payab...

PT-2023-23951 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions prior to 0.3.8 Description: In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This issue was fixed by the remov...

Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment

Impact during codegen, the length word of a dynarray is written before the data, which can result in OOB array access in the case where the dynarray is on both the lhs and rhs of an assignment. here is a minimal example producing the issue: vyper a:DynArrayuint256,3 @external def test -...