Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible, typechecking is bypassed. The ability to pass kwargs to internal functions is an undocumented feature that is not well known about. The issue is patched in version 0.3.8.
References
| Link | Resource |
|---|---|
| https://github.com/vyperlang/vyper/commit/c3e68c302aa6e1429946473769dd1232145822ac | Patch |
| https://github.com/vyperlang/vyper/security/advisories/GHSA-ph9x-4vc9-m39g | Exploit Vendor Advisory |
Configurations
History
02 Aug 2023, 16:22
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Vyperlang
Vyperlang vyper |
|
| CPE | cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:* |
23 May 2023, 19:07
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Vyper Project
Vyper Project vyper |
|
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | (MISC) https://github.com/vyperlang/vyper/commit/c3e68c302aa6e1429946473769dd1232145822ac - Patch | |
| References | (MISC) https://github.com/vyperlang/vyper/security/advisories/GHSA-ph9x-4vc9-m39g - Exploit, Vendor Advisory | |
| CPE | cpe:2.3:a:vyper_project:vyper:*:*:*:*:*:*:*:* |
11 May 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-11 22:15
Updated : 2023-08-02 16:22
NVD link : CVE-2023-32059
Mitre link : CVE-2023-32059
JSON object : View
Products Affected
vyperlang
- vyper
CWE