GitHub Advisoryadvisory · PyPI
GHSA-4hg4-9mf5-wxxq incorrect order of evaluation of side effects for some builtins
MEDIUM
Official page ↗
- Aliases
- CVE-2023-41052
- Ecosystem
- PyPI
- Packages
- vyper
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-670
- Reviewed
- 2023-09-04
Affected packages
• PyPI vyper: < 0.3.10 → fixed in 0.3.10
Description
Impact
The order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order.
• For `uint256_addmod(a,b,c)` and `uint256_mulmod(a,b,c)`, the order is `c,a,b`.
• For `ecadd(a,b)` and `ecmul(a,b)`, the order is `b,a`.
Note that this behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on.
Patches
https://github.com/vyperlang/vyper/pull/3583
Workarounds
When using builtins from the list above, make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.
Related
Alias · CVE (1)
- CVE-2023-41052 Vyper is a Pythonic Smart Contract Language. vulnerability
Weakness · CWE (1)
- CWE-670 Always-Incorrect Control Flow Implementation weakness
References
- https://github.com/vyperlang/vyper/security/advisories/GHSA-4hg4-9mf5-wxxq web
- https://nvd.nist.gov/vuln/detail/CVE-2023-41052 advisory
- https://github.com/vyperlang/vyper/pull/3583 web
- https://github.com/vyperlang/vyper/commit/78fa8dd8f91ba0cb26277eeffb585c68c83e7daa web
- https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-168.yaml web
- https://github.com/vyperlang/vyper package