CVE-2020-37288Medium· 3.7▾ SunlitVyper: Return inside for loop more than 1 level deep
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
Last analysed / modified upstream
low → medium
0.3% → 0.3%
Earlier today, we received a responsible disclosure of a potential issue from @michwill (developer of @curvefi) for Vyper users who use return statements inside for loops of nested internal calls. Returning inside a for loop causes an invalid jump dest, reverting the transaction unnecessarily.
MWE:
@internal
def _baz():
for i in range(1):
return # Stack underflow happens here
@internal
def _bar():
self._baz()
@external
def foo():
self._bar()
Impact is minor, it is unlikely a user would encounter this problem unless they were working with nested calls, and return statements inside calls. Even in that scenario, you would encounter a revert which should be noticeable with adequate testing. In limited circumstances, this could cause a DoS attack for public contracts under certain conditions.
Fixed in https://github.com/vyperlang/vyper/pull/2110. Please upgrade to Vyper 0.2.3
Not returning inside a for loop nested 2+ internal calls deep works as is:
@internal
def _baz():
for i in range(1):
pass
return # This works fine
@internal
def _bar():
self._baz()
@external
def foo():
self._bar()
If you have any questions or comments about this advisory:
vyper >= 0.1.0b10, < 0.2.3Upgrade to a patched release:
vyper 0.2.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
GHSA-vg88-3v92-rjx2MediumVyper: Return inside for loop more than 1 level deep
CVE-2023-41052Medium· 5.3incorrect order of evaluation of side effects for some builtins
CVE-2020-37286Medium· 6.5Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls
CVE-2020-37287Medium· 5.9Vyper: Call stack corruption when passing complex type containing non-base type members as argument
GHSA-2r3x-4mrv-mcxfMediumVyper: Memory corruption using function calls within tuples / nested calls
GHSA-4v7v-gqf9-ww2gMediumVyper: Call stack corruption when passing complex type containing non-base type members as argument