Kurz gesagt
- CVE-2021-48018 ist eine Schwachstelle (HOCH (CVSS 7.4)) in vyper.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.39%, höher als bei 33.3% aller Schwachstellen.
- Abhilfe: auf 0.2.15 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| vyper PyPI | ≥ 0.2.13, < 0.2.15
| 0.2.15
|
Description
Background
When attempting to use the v0.2.14 release, @pandadefi discovered an issue using the @nonreentrant decorator.
Impact
Reentrancy protection storage slots get allocated to the same slots as storage variables, leading to the corruption of storage variables when using the @nonreentrant decorator.
Patches
This issue was fixed in v0.2.15 in #2391, #2379
Workarounds
Don't use the @nonreentrant decorator in these versions.
NVD description
Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract's intended logic.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free