CVE-2023-32059High· 7.5▾ TwilightVyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.7%
Internal calls to internal functions with more than 1 default argument are compiled incorrectly. Depending on the number of arguments
provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible,
typechecking is bypassed. In the bar() function in the following code, self.foo(13) is compiled to
self.foo(13,12) instead of self.foo(13,1337).
@internal
def foo(a:uint256 = 12, b:uint256 = 1337):
pass
@internal
def bar():
self.foo(13)
note that at the time of publication, the ability to pass kwargs to internal functions is an undocumented feature that does not seem to be widely used.
patched in c3e68c302aa6e1429946473769dd1232145822ac
Is there a way for users to fix or remediate the vulnerability without upgrading?
Are there any links users can visit to find out more?
vyper < 0.3.8Upgrade to a patched release:
vyper 0.3.8Connected by shared product, vendor, weakness, or advisory.
CVE-2024-24567Medium· 4.8Vyper's raw_call `value=` kwargs not disabled for static and delegate calls
CVE-2023-30629High· 7.5Incorrect success value returned in vyper
CVE-2025-21607LowVyper Does Not Check the Success of Certain Precompile Calls
CVE-2023-30837High· 7.5vyper vulnerable to storage allocator overflow
CVE-2024-24560Low· 3.7Vyper's external calls can overflow return data to return input buffer
CVE-2024-24561Critical· 9.8Vyper's bounds check on built-in `slice()` function can be overflowed