En resumen
- CVE-2021-48018 es una vulnerabilidad ALTO (CVSS 7.4) que afecta a vyper.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.39%, mayor que el 33.3% de las vulnerabilidades.
- Solución: actualizar a 0.2.15 o posterior.
| Package | Affected versions | Patched versions |
|---|
| vyper PyPI | ≥ 0.2.13, < 0.2.15
| 0.2.15
|
Description
Background
When attempting to use the v0.2.14 release, @pandadefi discovered an issue using the @nonreentrant decorator.
Impact
Reentrancy protection storage slots get allocated to the same slots as storage variables, leading to the corruption of storage variables when using the @nonreentrant decorator.
Patches
This issue was fixed in v0.2.15 in #2391, #2379
Workarounds
Don't use the @nonreentrant decorator in these versions.
NVD description
Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract's intended logic.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free