GitHub Advisoryadvisory · PyPI
GHSA-7f92-rr6w-cq64 Storage corruption due to variables overwritten by re-entrancy locks
HIGH
Official page ↗
- Ecosystem
- PyPI
- Packages
- vyper
- Severity
- High
- Reviewed
- 2021-08-02
Affected packages
• PyPI vyper: >= 0.2.13, < 0.2.15 → fixed in 0.2.15
Description
Background
When attempting to use the v0.2.14 release, @pandadefi discovered an issue using the `@nonreentrant` decorator.
Impact
Reentrancy protection storage slots get allocated to the same slots as storage variables, leading to the corruption of storage variables when using the `@nonreentrant` decorator.
Patches
This issue was fixed in v0.2.15 in #2391, #2379
Workarounds
Don't use the `@nonreentrant` decorator in these versions.