CVE-2023-30629
HIGHvyper 0.3.1-0.3.7 - Always-Incorrect Control Flow Implementation in raw_call
Title source: llmDescription
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the `raw_call` with `revert_on_failure=False` and `max_outsize=0` receives the wrong response from `raw_call`. Depending on the memory garbage, the result can be either `True` or `False`. A patch is available and, as of time of publication, anticipated to be part of Vyper 0.3.8. As a workaround, one may always put `max_outsize>0`.
References (5)
Core 5
Core References
Exploit, Vendor Advisory x_refsource_confirm
https://github.com/vyperlang/vyper/security/advisories/GHSA-w9g2-3w7p-72g9
Patch x_refsource_misc
https://github.com/lidofinance/gate-seals/pull/5/files
Patch x_refsource_misc
https://github.com/vyperlang/vyper/commit/851f7a1b3aa2a36fd041e3d0ed38f9355a58c8ae
Product x_refsource_misc
https://docs.vyperlang.org/en/v0.3.7/built-in-functions.html#raw_call
Scores
CVSS v3
7.5
EPSS
0.0088
EPSS Percentile
54.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-670
Status
published
Products (2)
pypi/vyper
0.3.1 - 0.3.8PyPI
vyperlang/vyper
0.3.1 - 0.3.8
Published
Apr 24, 2023
Tracked Since
Feb 18, 2026