CVE-2023-32675

CVSS V2 None CVSS V3 None
Description
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the removal of the global `calldatasize` check in commit `02339dfda`. Users are advised to upgrade to version 0.3.8. Users unable to upgrade should avoid use of nonpayable default functions.
Overview
  • CVE ID
  • CVE-2023-32675
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Received
  • Published Version
  • 2023-05-19T20:15:09
  • Last Modified Date
  • 2023-05-19T20:15:09
Weakness Enumerations
CWE URL
CWE-670 http://cwe.mitre.org/data/definitions/670.html
References
Reference URL Reference Tags
https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520.
https://github.com/vyperlang/vyper/security/advisories/GHSA-vxmm-cwh2-q762
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-32675
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32675
History
Created Old Value New Value Data Type Notes
2023-05-19 21:00:29 Added to TrackCVE
2023-05-19 21:00:29 Weakness Enumeration new