// For flags

CVE-2022-24845

Integer bounds error in Vyper

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()` is not validated to fall within the bounds of `int128`. This issue can result in a misinterpretation of the integer value and lead to incorrect behavior. As of v0.3.0, `<iface>.returns_int128()` is validated in simple expressions, but not complex expressions. Users are advised to upgrade. There is no known workaround for this issue.

Vyper es un Lenguaje de Contrato Inteligente pitónico para la máquina virtual de Ethereum. En las versiones afectadas, el retorno de "(iface).returns_int128()" no es comprobado que esté dentro de los límites de "int128". Este problema puede resultar en una mala interpretación del valor entero y conllevar a un comportamiento incorrecto. A partir de la versión 0.3.0, "(iface).returns_int128()" es comprobado en expresiones simples, pero no en expresiones complejas. Es recomendado a usuarios actualizar. No se presenta medidas de mitigación conocidas para este problema

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-02-10 CVE Reserved
  • 2022-04-13 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • 2024-11-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-190: Integer Overflow or Wraparound
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Vyperlang
Search vendor "Vyperlang"
Vyper
Search vendor "Vyperlang" for product "Vyper"
< 0.3.2
Search vendor "Vyperlang" for product "Vyper" and version " < 0.3.2"
-
Affected