Threat Intelligence Database

Vyper versions 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 have a vulnerability in the handling of Unicode encoding in the parsing of source code. The issue arises from mixing character-based line offsets with Python's UTF-8 byte column offsets, causing multi-byte characters to shift source slices used for reconstructing numeric literals. This allows an attacker to use non-ASCII identifiers that normalize to ASCII or invisible byte-order marks to silently substitute addresses, integers, or other constants in compiled code.

A memory corruption vulnerability exists in Vyper versions prior to 0.2.6 when performing function calls inside tuples or nested function calls. This occurs due to an incorrect pointer to the tip of the stack during such calls. The issue was fixed in Vyper version 0.2.6.

A vulnerability in Vyper prior to version 0.2.6 causes call stack corruption when passing multi-dimensional arrays as arguments to internal or external functions. This occurs due to incorrect assumptions about the size of array or struct subtypes during stack management, leading to incorrect output.

A vulnerability in Vyper versions from 0.1.0b10 up to but not including 0.2.3 causes a transaction revert when a return statement is used inside a for loop nested more than one level deep in internal calls. This results in an invalid jump destination and a stack underflow error. The impact is minor and mainly causes unnecessary transaction reverts, but under certain conditions, it could lead to a denial-of-service (DoS) on public contracts. The issue is fixed in Vyper 0.2.3.

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the `build_IR` for `concat` doesn't properly adhere to the API of copy functions (for `>=0.3.2` the `copy_bytes` function). A contract search was performed and no vulnerable contracts were found in production. The buffer overflow can result in the change of semantics of the contract. The overflow is length-dependent and thus it might go unnoticed during contract testing. However, certainly not all usages of concat will result in overwritten valid data as we require it to be in an internal function and close to the return statement where other memory allocations don't occur. This issue has been addressed in 0.4.0.

HighVulnerabilityGermanyFranceNetherlands+4#cve#cve-2024-22419#cwe-120