CVEvulnerability

CVE-2024-32648

5.3 MEDIUM Published 2024-04-25 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-04-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-667

Description

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don't respect nonreentrancy keys and the lock isn't emitted. No vulnerable production contracts were found. Additionally, using a lock on a `default` function is a very sparsely used pattern. As such, the impact is low. Version 0.3.0 contains a patch for the issue.

Affected configurations

• vyperlang vyper (< 0.3.0)

Related

Weakness · CWE (1)

  • CWE-667 Improper Locking weakness

References