// For flags

CVE-2023-41052

Vyper: incorrect order of evaluation of side effects for some builtins

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.

Vyper es un Lenguaje de Contrato Inteligente de Python. En las versiones afectadas, el orden de evaluación de los argumentos de las funciones integradas `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` no sigue el orden de origen. Este comportamiento es problemático cuando la evaluación de uno de los argumentos produce efectos secundarios de los que dependen otros argumentos. Actualmente se está desarrollando un parche mediante la solicitud de extracción #3583. Al utilizar elementos integrados de la lista anterior, los usuarios deben asegurarse de que los argumentos de la expresión no produzcan efectos secundarios o, si los produce, que ningún otro argumento dependa de esos efectos secundarios.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-08-22 CVE Reserved
  • 2023-09-04 CVE Published
  • 2024-09-26 CVE Updated
  • 2024-09-26 First Exploit
  • 2024-10-06 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-670: Always-Incorrect Control Flow Implementation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Vyperlang
Search vendor "Vyperlang"
Vyper
Search vendor "Vyperlang" for product "Vyper"
<= 0.3.9
Search vendor "Vyperlang" for product "Vyper" and version " <= 0.3.9"
python
Affected