---
id: CVE-2023-41052
aliases:
  - GHSA-4hg4-9mf5-wxxq
  - PYSEC-2023-168
title: incorrect order of evaluation of side effects for some builtins
summary: incorrect order of evaluation of side effects for some builtins
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
vendor: vyper
product: vyper
ecosystem: pip
affected:
  - vyper < 0.3.10
patched:
  - vyper 0.3.10
published: '2023-09-04'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T19:30:05.529230739Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-4hg4-9mf5-wxxq'
references:
  - url: 'https://github.com/vyperlang/vyper/security/advisories/GHSA-4hg4-9mf5-wxxq'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-41052'
  - url: 'https://github.com/vyperlang/vyper/pull/3583'
  - url: >-
      https://github.com/vyperlang/vyper/commit/78fa8dd8f91ba0cb26277eeffb585c68c83e7daa
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-168.yaml
  - url: 'https://github.com/vyperlang/vyper'
  - url: 'https://github.com/advisories/GHSA-4hg4-9mf5-wxxq'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00536
epssPercentile: 0.4277
cwe:
  - CWE-670
ingestedAt: '2026-09-12T03:13:01.653Z'
---

## Overview

### Impact
The order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order.
• For `uint256_addmod(a,b,c)` and `uint256_mulmod(a,b,c)`, the order is `c,a,b`.
• For `ecadd(a,b)` and `ecmul(a,b)`, the order is `b,a`.

Note that this behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. 

### Patches
https://github.com/vyperlang/vyper/pull/3583

### Workarounds
When using builtins from the list above, make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.

## Affected packages

- `vyper < 0.3.10`

## Remediation

Upgrade to a patched release:

- `vyper 0.3.10`