Skip to content

incorrect order of evaluation of side effects for some builtins

Moderate severity GitHub Reviewed Published Sep 2, 2023 in vyperlang/vyper • Updated Nov 7, 2023

Package

pip vyper (pip)

Affected versions

<= 0.3.9

Patched versions

0.3.10

Description

Impact

The order of evaluation of the arguments of the builtin functions uint256_addmod, uint256_mulmod, ecadd and ecmul does not follow source order.
• For uint256_addmod(a,b,c) and uint256_mulmod(a,b,c), the order is c,a,b.
• For ecadd(a,b) and ecmul(a,b), the order is b,a.

Note that this behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on.

Patches

vyperlang/vyper#3583

Workarounds

When using builtins from the list above, make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.

References

Are there any links users can visit to find out more?

References

@charles-cooper charles-cooper published to vyperlang/vyper Sep 2, 2023
Published to the GitHub Advisory Database Sep 4, 2023
Reviewed Sep 4, 2023
Published by the National Vulnerability Database Sep 4, 2023
Last updated Nov 7, 2023

Severity

Moderate
5.3
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CVE ID

CVE-2023-41052

GHSA ID

GHSA-4hg4-9mf5-wxxq

Source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.