CVE-2023-40015

Vyper CVE-2023-40015 describes a compiler behavior issue where the argument evaluation order for a set of expressions is from right to left instead of left to right. The affected language constructs include unsafe_add, unsafe_sub, unsafe_mul, unsafe_div, pow_mod256, bitwise operators (|, &, ^, an...

CVE-2023-40015 Vyper: reversed order of side effects for some operations

Vyper is a Pythonic Smart Contract Language. For the following probably non-exhaustive list of expressions, the compiler evaluates the arguments from right to left instead of left to right. unsafeadd, unsafesub, unsafemul, unsafediv, powmod256, |, &, ^ bitwise operators, bitwiseor deprecated,...

CVE-2023-41052

Vyper CVE-2023-41052 affects the Pythonic smart contract language Vyper. In affected versions, the evaluation order of arguments to builtins uint256_addmod, uint256_mulmod, ecadd, and ecmul does not follow source order, which can cause side effects in one argument to be relied upon by others. The...

CVE-2023-41052 Vyper: incorrect order of evaluation of side effects for some builtins

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions uint256addmod, uint256mulmod, ecadd and ecmul does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side...

CVE-2023-41052 Vyper: incorrect order of evaluation of side effects for some builtins

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions uint256addmod, uint256mulmod, ecadd and ecmul does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side...

CVE-2023-41052 Vyper: incorrect order of evaluation of side effects for some builtins

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions uint256addmod, uint256mulmod, ecadd and ecmul does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side...

2vyper (=0.3.0), ape-vyper (>=0.7.1 <=0.8.3) +23 more potentially affected by CVE-2023-41052 via vyper (>=0.1.0b12 <=0.3.10)

vyper PYPI version =0.1.0b12, =0.7.1, =0.1.0, =0.0.0, =0.0.0, =0.0.5, =0.1.0, =0.1.0, =0.1.10.0, =1.0.1, =0.1.0, =1.4.0, =0.2.1, =0.1.3, =0.1.10 and more Source cves: CVE-2023-41052 Source advisory: OSV:GHSA-4HG4-9MF5-WXXQ...

2vyper (=0.3.0), ape-dasy (=0.1.0) +30 more potentially affected by CVE-2023-40015 via vyper (>=0.1.0b12 <=0.4.1)

vyper PYPI version =0.1.0b12, =0.7.1, =0.1.0, =0.0.0, =0.0.0, =0.0.5, =0.1.0, =0.1.0, =0.7.2, =0.1.10.0, =1.0.1, =0.1.0, =1.4.0, =1.21.0 and more Source cves: CVE-2023-40015 Source advisory: OSV:GHSA-G2XH-C426-V8MF...

Vyper: reversed order of side effects for some operations

Impact For the following probably non-exhaustive list of expressions, the compiler evaluates the arguments from right to left instead of left to right. - unsafeadd - unsafesub - unsafemul - unsafediv - powmod256 - |, &, ^ bitwise operators - bitwiseor deprecated - bitwiseand deprecated - bitwisex...

GHSA-G2XH-C426-V8MF Vyper: reversed order of side effects for some operations

Impact For the following probably non-exhaustive list of expressions, the compiler evaluates the arguments from right to left instead of left to right. - unsafeadd - unsafesub - unsafemul - unsafediv - powmod256 - |, &, ^ bitwise operators - bitwiseor deprecated - bitwiseand deprecated - bitwisex...

PT-2023-27764 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper affected versions not specified Description: The order of evaluation of the arguments of the builtin functions uint256 addmod, uint256 mulmod, ecadd, and ecmul does not follow source order. This behavior is problematic when the evaluati...

PT-2023-27210 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper affected versions not specified Description: The Vyper compiler evaluates arguments from right to left instead of left to right for certain expressions, including unsafe add, unsafe sub, unsafe mul, unsafe div, pow mod256, |, &, ^ bitwi...

Vyper Security Vulnerability

Vyper is the Pythonic smart contract language for EVM. A security vulnerability exists in Vyper version 0.3.9 and earlier, which stems from the compiler calculating parameters from right-to-left instead of left-to-right...

Vyper Security Vulnerability

Vyper is the Pythonic smart contract language for EVM. A security vulnerability exists in Vyper version 0.3.9 and earlier versions, which stems from the fact that the order in which the parameters of the built-in functions "uint256addmod", "uint256mulmod", "ecadd" and "ecmul" are evaluated does n...

Vyper has incorrectly allocated named re-entrancy locks

Impact In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of...

GHSA-5824-CM3X-3C38 Vyper has incorrectly allocated named re-entrancy locks

Impact In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of...

avotes-parser-cli (>=0.0.0 <=0.4.3), avotes-parser-core (>=0.0.0 <=0.4.3) +5 more potentially affected by CVE-2023-39363 via vyper (>=0.2.15 <=0.3.0)

vyper PYPI version =0.2.15, =0.0.0, =0.0.0, =0.4.3, =1.15.1, =0.2.1, =2.0.36, =2.1.22 Source cves: CVE-2023-39363 Source advisory: OSV:GHSA-5824-CM3X-3C38...

Incorrect Re-Entrancy Lock Allocation

vyper is vulnerable to Incorrect Re-Entrancy Lock Allocation. The allocation of named re-entrancy locks is flawed, which makes cross-function re-entrancy possible in contracts, because each function employing a named re-entrancy lock receives a distinct lock independent of the key under a specifi...

CVE-2023-39363

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

PYSEC-2023-142

Vyer is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...