GitHub Advisoryadvisory · PyPI

GHSA-7f92-rr6w-cq64 Storage corruption due to variables overwritten by re-entrancy locks

HIGH Published 2021-08-05 Modified 2021-08-02 Official page ↗
Ecosystem
PyPI
Packages
vyper
Severity
High
Reviewed
2021-08-02

Affected packages

• PyPI vyper: >= 0.2.13, < 0.2.15 → fixed in 0.2.15

Description

Background When attempting to use the v0.2.14 release, @pandadefi discovered an issue using the `@nonreentrant` decorator. Impact Reentrancy protection storage slots get allocated to the same slots as storage variables, leading to the corruption of storage variables when using the `@nonreentrant` decorator. Patches This issue was fixed in v0.2.15 in #2391, #2379 Workarounds Don't use the `@nonreentrant` decorator in these versions.

References