CVE-2023-41052
Description
Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.
How to fix
- vyper0.3.10, 0.3.10rc1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vyperlang vyper | v ≤ 0.3.9 | — |
| vyperPyPI | v < 0.3.10, v < 0.3.10rc1 | 0.3.10, 0.3.10rc1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.