CVE-2023-32059High· 7.5▾ TwilightVyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.7%
Internal calls to internal functions with more than 1 default argument are compiled incorrectly. Depending on the number of arguments
provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible,
typechecking is bypassed. In the bar() function in the following code, self.foo(13) is compiled to
self.foo(13,12) instead of self.foo(13,1337).
@internal
def foo(a:uint256 = 12, b:uint256 = 1337):
pass
@internal
def bar():
self.foo(13)
note that at the time of publication, the ability to pass kwargs to internal functions is an undocumented feature that does not seem to be widely used.
patched in c3e68c302aa6e1429946473769dd1232145822ac
Is there a way for users to fix or remediate the vulnerability without upgrading?
Are there any links users can visit to find out more?
vyper < 0.3.8Upgrade to a patched release:
vyper 0.3.8Connected by shared product, vendor, weakness, or advisory.
CVE-2020-37288Medium· 3.7Vyper: Return inside for loop more than 1 level deep
CVE-2020-37286Medium· 6.5Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls
CVE-2020-37287Medium· 5.9Vyper: Call stack corruption when passing complex type containing non-base type members as argument
GHSA-vg88-3v92-rjx2MediumVyper: Return inside for loop more than 1 level deep
GHSA-2r3x-4mrv-mcxfMediumVyper: Memory corruption using function calls within tuples / nested calls
GHSA-4v7v-gqf9-ww2gMediumVyper: Call stack corruption when passing complex type containing non-base type members as argument