Skip to content
OpenAdvisories
High · 8.2 CVE-2022-29255 EUVD-2022-0356GHSA-4v9q-cgpw-cf38PYSEC-2022-43053

Multiple evaluation of contract address in call in vyper

Published Jun 6, 2022 · Updated Apr 22, 2025 · Assigned by GitHub_M

Description

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.

Affected products

VendorProductAffectedFixed
vyperlang vyper < 0.3.4 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI vyper < 0.3.4 0.3.4 GHSA-4v9q-cgpw-cf38

References