GitHub Advisoryadvisory · PyPI

GHSA-c7pr-343r-5c46 missing clamps for decimal args in external functions

MEDIUM Published 2021-10-06 Modified 2024-11-18 Official page ↗
Aliases
CVE-2021-41122
Ecosystem
PyPI
Packages
vyper
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-682
Reviewed
2021-10-06

Affected packages

• PyPI vyper: < 0.3.0 → fixed in 0.3.0

Description

Impact The following code does not properly validate that its input is in bounds. ```python @external def foo(x: decimal) -> decimal: return x ``` Patches 0.3.0 / #2447 Workarounds Don't use decimal args

Related

Alias · CVE (1)

  • CVE-2021-41122 Vyper is a Pythonic Smart Contract Language for the EVM. vulnerability

Weakness · CWE (1)

  • CWE-682 Incorrect Calculation weakness

References