GitHub Advisoryadvisory · PyPI
GHSA-vxmm-cwh2-q762 Vyper's nonpayable default functions are sometimes payable
MEDIUM
Official page ↗
- Aliases
- CVE-2023-32675
- Ecosystem
- PyPI
- Packages
- vyper
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-670
- Reviewed
- 2023-05-22
Affected packages
• PyPI vyper: < 0.3.8 → fixed in 0.3.8
Description
Impact
in contracts with at least one regular nonpayable function, due to the callvalue check being inside of the selector section, it is possible to send funds to the default function by using less than 4 bytes of calldata, even if the default function is marked `nonpayable`. this applies to contracts compiled with vyper uint256:
return 1
implicitly nonpayable
@external
def __default__():
# could receive ether here
pass
```
Patches
this was fixed by the removal of the global calldatasize check in https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520.
Workarounds
don't use nonpayable default functions
Related
Alias · CVE (1)
- CVE-2023-32675 Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. vulnerability
Weakness · CWE (1)
- CWE-670 Always-Incorrect Control Flow Implementation weakness
References
- https://github.com/vyperlang/vyper/security/advisories/GHSA-vxmm-cwh2-q762 web
- https://nvd.nist.gov/vuln/detail/CVE-2023-32675 advisory
- https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520 web
- https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520. web
- https://github.com/vyperlang/vyper/commit/903727006c1e5ebef99fa9fd5d51d62bd33d72a9 web
- https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-80.yaml web
- https://github.com/vyperlang/vyper package