{"id":"CVE-2023-46247","aliases":["GHSA-6m97-7527-mh74","PYSEC-2023-307"],"title":"incorrect storage layout for contracts containing large arrays","summary":"incorrect storage layout for contracts containing large arrays","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","vendor":"vyper","product":"vyper","ecosystem":"pip","affected":["vyper < 0.3.8"],"patched":["vyper 0.3.8"],"published":"2023-12-13","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:59.391185148Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6m97-7527-mh74","references":[{"url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-6m97-7527-mh74"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46247"},{"url":"https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bb"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-307.yaml"},{"url":"https://github.com/vyperlang/vyper"},{"url":"https://github.com/vyperlang/vyper/blob/6020b8bbf66b062d299d87bc7e4eddc4c9d1c157/vyper/semantics/validation/data_positions.py#L197"}],"tags":["osv","pip"],"epss":0.00697,"epssPercentile":0.51633,"ingestedAt":"2026-09-12T03:13:01.666Z","slug":"CVE-2023-46247","body":"## Overview\n\n### Impact\ncontracts containing large arrays might underallocate the number of slots they need. prior to v0.3.8, the calculation to determine how many slots a storage variable needed used `math.ceil(type_.size_in_bytes / 32)`:\n\nhttps://github.com/vyperlang/vyper/blob/6020b8bbf66b062d299d87bc7e4eddc4c9d1c157/vyper/semantics/validation/data_positions.py#L197\n\nthe intermediate floating point step can produce a rounding error if there are enough bits set in the IEEE-754 mantissa. roughly speaking, if `type_.size_in_bytes` is large (> 2**46), and slightly less than a power of 2, the calculation can overestimate how many slots are needed. if `type_.size_in_bytes` is slightly more than a power of 2, the calculation can underestimate how many slots are needed.\n\nthe following two example contracts can result in overwriting of the variable `vulnerable`:\n```vyper\nlarge_array: address[2**64 + 1]  # type_.size_in_bytes == 32 * (2**64 + 1); math.ceil(type_.size_in_bytes / 32) < 2**64 + 1\nvulnerable: uint256\n\n# writing to self.large_array[2**64] will overwrite self.vulnerable\n```\n```vyper\nlarge_dynarray: DynArray[address, 2**64]  # Dynarray has a length word in front, its size in bytes is 32 * (2**64 + 1)\nvulnerable: uint256\n\n# writing to self.large_dynarray[2**64 - 1] will overwrite self.vulnerable\n```\n\nnote that in the latter case, the risk of `vulnerable` being overwritten is relatively small, since it would cost roughly $1.45 million trillion USD at today's gas prices (gas price 20gwei, ETH ~= $1800) in order to extend the DynArray to its full container size.\n\n### Patches\npatched by v0.3.8, specifically in commit https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bb.\n\n## Affected packages\n\n- `vyper < 0.3.8`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `vyper 0.3.8`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}