CVE-2024-24559

Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the IR for sha364. Concretely, the height variable is miscalculated. The vulnerability can't be triggered without writing the IR by hand that is, it cannot be triggered from regular...

CVE-2024-24559 Vyper SHA3 code generation bug

Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the IR for sha364. Concretely, the height variable is miscalculated. The vulnerability can't be triggered without writing the IR by hand that is, it cannot be triggered from regular...

CVE-2024-24559 Vyper SHA3 code generation bug

Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the IR for sha364. Concretely, the height variable is miscalculated. The vulnerability can't be triggered without writing the IR by hand that is, it cannot be triggered from regular...

CVE-2024-24559

CVE-2024-24559 : Vyper SHA3 codegen bug due to miscalculated height in IR for sha3_64. Can only be triggered with hand-written IR; not exposed by regular vyper code. Public advisories describe a low-impact issue, with a hand-written IR PoC and a patch patch (PR 4063) fixing the problem. Exploitat...

fp-evm (1.0.0), fp-rpc (1.0.0) +10 more potentially affected by CVE-2021-29511 via evm (0.25.0)

evm CARGO version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on evm and may be impacted: - fp-evm 1.0.0 - fp-rpc 1.0.0 - fp-storage 1.0.0 - pallet-ethereum 1.0.0 - pallet-evm 3.0.0 - pallet-evm-precompile-blake2 1.0.0 -...

GHSA-4JWQ-572W-4388 Memory over-allocation in evm crate

Impact Prior to the patch, when executing specific EVM opcodes related to memory operations that use evmcore::Memory::copylarge, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. Patches The flaw was corrected in comm...

Memory over-allocation in evm crate

Impact Prior to the patch, when executing specific EVM opcodes related to memory operations that use evmcore::Memory::copylarge, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. Patches The flaw was corrected in comm...

etclient (0.3.0), evm-network (>=0.11.0-beta.0, <=0.11.0) +10 more potentially affected by CVE-2021-29511 via evm (>=0.7.1, <=0.17.3)

evm CARGO version =0.7.1, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.7.0, =2.0.0-alpha.3, =2.0.1 Source cves: CVE-2021-29511 Source advisory: OSV:GHSA-4JWQ-572W-4388...

evm (>=0.22.0, <=0.22.1), evm-gasometer (0.22.0) +1 more potentially affected by CVE-2021-29511 via evm-core (0.22.0)

evm-core CARGO version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on evm-core and may be impacted: - evm =0.22.0, =0.22.1 - evm-gasometer 0.22.0 - evm-runtime 0.22.0 Source cves: CVE-2021-29511 Source advisory: OSV:GHSA-4JWQ-572W-4388...

evm (>=0.13.0, <=0.20.0), evm-gasometer (>=0.13.0, <=0.20.0) +2 more potentially affected by CVE-2021-29511 via evm-core (>=0.13.1, <=0.20.0)

evm-core CARGO version =0.13.1, =0.13.0, =0.13.0, =0.13.0, =2.0.0-alpha.3, =2.0.1 Source cves: CVE-2021-29511 Source advisory: OSV:GHSA-4JWQ-572W-4388...

CVE-2024-24567

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin rawcall even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics o...

Code injection

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin rawcall even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics o...

CVE-2024-24567 raw_call `value=` kwargs not disabled for static and delegate calls

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin rawcall even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics o...

CVE-2024-24567

The CVE-2024-24567 issue concerns Vyper, a Pythonic language for the Ethereum VM. The vulnerability is in the Vyper compiler’s raw_call builtin, where a value argument can be passed even when the call is delegatecall or staticcall. However, due to the semantics of delegatecall/staticcall opcodes,...

GHSA-X2C2-Q32W-4W6M Vyper's raw_call `value=` kwargs not disabled for static and delegate calls

Summary Vyper compiler allows passing a value in builtin rawcall even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the value=...

Vyper's raw_call `value=` kwargs not disabled for static and delegate calls

Summary Vyper compiler allows passing a value in builtin rawcall even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the value=...

Rust EVM erroneousle handles `record_external_operation` error return

Impact In rust-evm, a feature called recordexternaloperation was introduced, allowing library users to record custom gas changes. This feature can have some bogus interactions with the call stack. In particular, during finalization of a CREATE or CREATE2, in the case that the substack execution...

etclient (0.3.0), eth-utils (>=0.1.1, <=0.2.0) +32 more potentially affected by CVE-2024-21629 via evm (>=0.7.1, <=0.33.1)

evm CARGO version =0.7.1, =0.1.1, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.7.0, =1.0.0, =1.0.0, =2.1.0 and more Source cves: CVE-2024-21629 Source advisory: OSV:GHSA-27WG-99G8-2V4V...

GHSA-27WG-99G8-2V4V Rust EVM erroneousle handles `record_external_operation` error return

Impact In rust-evm, a feature called recordexternaloperation was introduced, allowing library users to record custom gas changes. This feature can have some bogus interactions with the call stack. In particular, during finalization of a CREATE or CREATE2, in the case that the substack execution...

CVE-2024-21629

Rust EVM is an Ethereum Virtual Machine interpreter. In rust-evm, a feature called recordexternaloperation was introduced, allowing library users to record custom gas changes. This feature can have some bogus interactions with the call stack. In particular, during finalization of a CREATE or...