CVE-2024-32646 vyper performs double eval of the slice args when buffer from adhoc locations

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the slice builtin can result in a double eval vulnerability when the buffer argument is either msg.data, self.code or .code and either the start or length arguments have side-effects...

CVE-2024-32645 vyper performs incorrect topic logging in raw_log

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when rawlog builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in...

CVE-2024-32645 vyper performs incorrect topic logging in raw_log

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when rawlog builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in...

CVE-2024-32645 vyper performs incorrect topic logging in raw_log

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when rawlog builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in...

CVE-2024-32645

Vyper (Pythonic smart contract language for the EVM) is affected by CVE-2024-32645 in versions 0.3.10 and earlier. The root cause is in the RawLog.build_IR path: it fails to unwrap variables provided as topics, causing incorrect values to be logged as topics. As of publication, no fixed version i...

PYSEC-2024-246

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a range of the form rangestart, start + N, if start is negative, the execution will always revert. This issue is caused by an incorrect assertion...

ape-dasy (=0.1.0), avotes-parser-cli (>=0.5.5.post5 <=0.5.6) +7 more potentially affected by CVE-2024-32481 via vyper (>=0.3.9 <=0.4.0)

vyper PYPI version =0.3.9, =0.5.5.post5, =0.5.5.post4, =0.0.1, =0.3.4, =0.8.31, =0.0.9, =3.4.7, =4.6.1 Source cves: CVE-2024-32481 Source advisory: OSV:PYSEC-2024-246...

CVE-2024-32481

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a range of the form rangestart, start + N, if start is negative, the execution will always revert. This issue is caused by an incorrect assertion...

PYSEC-2024-246

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a range of the form rangestart, start + N, if start is negative, the execution will always revert. This issue is caused by an incorrect assertion...

CVE-2024-32481 vyper's range(start, start + N) reverts for negative numbers

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a range of the form rangestart, start + N, if start is negative, the execution will always revert. This issue is caused by an incorrect assertion...

CVE-2024-32481 vyper's range(start, start + N) reverts for negative numbers

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a range of the form rangestart, start + N, if start is negative, the execution will always revert. This issue is caused by an incorrect assertion...

CVE-2024-32481

Vyper (Pythonic EVM language) is affected by CVE-2024-32481 in versions from 0.3.8 up to, but not including, 0.4.0b1. The vulnerability arises when looping with range(start, start + N) where start is negative; an incorrect assertion in the code generation of the range statement (stmt.parse_For_ra...

CVE-2024-32481 vyper's range(start, start + N) reverts for negative numbers

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a range of the form rangestart, start + N, if start is negative, the execution will always revert. This issue is caused by an incorrect assertion...

CVE-2024-32646

creationtimestamp| type| source ---|---|--- 2024-04-25 13:04:42+00:00| published-proof-of-concept| https://github.com/vyperlang/vyper/security/advisories/GHSA-r56x-j438-vw5m...

CVE-2024-32649

creationtimestamp| type| source ---|---|--- 2024-04-25 13:00:55+00:00| published-proof-of-concept| https://github.com/vyperlang/vyper/security/advisories/GHSA-5jrj-52x8-m64h...

CVE-2024-32647

creationtimestamp| type| source ---|---|--- 2024-04-25 13:00:49+00:00| published-proof-of-concept| https://github.com/vyperlang/vyper/security/advisories/GHSA-3whq-64q2-qfj6...

CVE-2024-32648

creationtimestamp| type| source ---|---|--- 2024-04-25 12:46:04+00:00| published-proof-of-concept| https://github.com/vyperlang/vyper/security/advisories/GHSA-m2v9-w374-5hj9...

CVE-2024-32645

creationtimestamp| type| source ---|---|--- 2024-04-25 12:36:44+00:00| published-proof-of-concept| https://github.com/vyperlang/vyper/security/advisories/GHSA-xchq-w5r3-4wg3...

CVE-2024-32481

creationtimestamp| type| source ---|---|--- 2024-04-25 12:34:00+00:00| published-proof-of-concept| https://github.com/vyperlang/vyper/security/advisories/GHSA-ppx5-q359-pvwj...

PT-2024-24742 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions 0.3.10 and prior Description: The issue arises from using the sqrt builtin in Vyper, which can result in a double eval vulnerability when the argument has side-effects. This occurs because the build IR function of the sqrt...