missing clamps for decimal args in external functions

概要

@external
def foo(x: decimal) -> decimal:
    return x

参考情報

• vyperlang/vyper security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2021-41122 · ADVISORY
• vyperlang/vyper#2447 · WEB
• pypa/advisory-database · WEB
• vyperlang/vyper · PACKAGE

vyper のその他の脆弱性

• CVE-2021-48020中 6.5Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function c…
• CVE-2021-48019中 4.8Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE …
• CVE-2021-48018高 7.4Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variabl…
• CVE-2020-37289低 3.7Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256…
• CVE-2020-37288低 3.7Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or mor…