Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-32675

Good to know:

icon
icon

Date: May 19, 2023

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the removal of the global `calldatasize` check in commit `02339dfda`. Users are advised to upgrade to version 0.3.8. Users unable to upgrade should avoid use of nonpayable default functions.

Language: Python

Severity Score

Related Resources (8)

https://nvd.nist.gov/vuln/detail/CVE-2023-32675
https://github.com/vyperlang/vyper/security/advisories/GHSA-vxmm-cwh2-q762
https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520
https://github.com/vyperlang/vyper/commit/903727006c1e5ebef99fa9fd5d51d62bd33d72a9
https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520.
https://github.com/vyperlang/vyper
https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-80.yaml
https://www.mend.io/vulnerability-database/CVE-2023-32675

Severity Score

Weakness Type (CWE)

Always-Incorrect Control Flow Implementation

CWE-670

Top Fix

icon

Upgrade Version

Upgrade to version vyper - 0.3.8

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us