Skip to content
OpenAdvisories
Low · 3.7 CVE-2023-41052 EUVD-2023-0267GHSA-4hg4-9mf5-wxxqPYSEC-2023-168

Vyper: incorrect order of evaluation of side effects for some builtins

Published Sep 4, 2023 · Updated Sep 26, 2024 · Assigned by GitHub_M

Description

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.

Affected products

VendorProductAffectedFixed
vyperlang vyper <= 0.3.9 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI vyper < 0.3.10 0.3.10 GHSA-4hg4-9mf5-wxxq
PyPI vyper < 0.3.10rc1 0.3.10rc1 PYSEC-2023-168

References