CVEvulnerability
CVE-2018-18920
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-11-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-119
Description
Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '"stack": [100, 100, 0]' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed indefinitely without gas being paid."
Affected configurations
• ethereum py-evm 0.2.0
Related
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
References
- https://github.com/ethereum/py-evm/issues/1448 Exploit, Third Party Advisory
- https://twitter.com/AlexanderFisher/status/1060923428641878019 Third Party Advisory
- https://twitter.com/NettaLab/status/1060889400102383617 Third Party Advisory
- https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx/ Third Party Advisory
- https://github.com/ethereum/py-evm/issues/1448 Exploit, Third Party Advisory
- https://twitter.com/AlexanderFisher/status/1060923428641878019 Third Party Advisory
- https://twitter.com/NettaLab/status/1060889400102383617 Third Party Advisory
- https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx/ Third Party Advisory