CVE-2020-37289

Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals, to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values...

CVE-2020-37289 Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values

Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals, to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values...

CVE-2020-37289

Vyper versions prior to 0.3.1 are vulnerable to improper input validation because the language lacks a native uint8 type. This allows interface return values explicitly declared as uint8 (e.g., ERC20.decimals() ) to be stored in uint256 variables without any bounds checking. Consequently, malicio...

Vyper input validation error vulnerability

Vyper versions prior to 0.3.1 contain an input validation error vulnerability. This stems from the absence of a uint8 type, allowing interface returns declared as uint8—such as ERC20.decimals—to be stored in uint256 variables without boundary checks. Malicious contracts can then return values...

WS-2020-0053

We determined the issue to be mild and unlikely to be exploited, with an easy workaround while the correct resolution is in process. The issue stems from a number of things, which we will detail here. 1 The ABI Specification is under-defined such that function return type is not always reflected ...

Vyper interfaces returning integer types less than 256 bits can be manipulated if uint256 is used

VVE-2020-0001 Earlier today, we received a responsible disclosure of a potential issue from @montyly security researcher at @trailofbits for Vyper users who make assumptions about what values certain interface types can return. Impact We determined the issue to be mild and unlikely to be exploite...

PT-2020-21417

Name of the Vulnerable Software and Affected Versions Vyper affected versions not specified Description The issue arises from the under-defined ABI Specification, which allows functions to return values that can be stored in variables of different types without explicit casting or input validatio...