CVE-2020-37286Medium· 6.5▾ SunlitVyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arg…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.
vyper >= 0.1.0b4 < 0.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-48018High· 7.4Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator
CVE-2021-48020Medium· 6.5Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays
GHSA-2r3x-4mrv-mcxfMediumVyper: Memory corruption using function calls within tuples / nested calls
CVE-2020-37288Low· 3.7Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops
CVE-2020-37289Low· 3.7Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values
CVE-2020-37287Medium· 5.9Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments