HIGH
Multiple evaluation of contract address in call in vyper
Published Jun 6, 2022
8.7
HIGHCVSS 4.0
EPSS 1.33%
Description
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.
Affected products
-
- Version < 0.3.4StatusaffectedConstraints-
- Version
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (6)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0356 Advisory
- https://github.com/advisories/GHSA-4v9q-cgpw-cf38 Advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2022-43053.yaml
- https://github.com/vyperlang/vyper/commit/6b4d8ff185de071252feaa1c319712b2d6577f8d x_refsource_MISCPatchThird Party Advisory
- https://github.com/vyperlang/vyper/security/advisories/GHSA-4v9q-cgpw-cf38 x_refsource_CONFIRMExploitMitigationThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-29255
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0356 | Advisory | |
| https://github.com/advisories/GHSA-4v9q-cgpw-cf38 | Advisory | |
| https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2022-43053.yaml | ||
| https://github.com/vyperlang/vyper/commit/6b4d8ff185de071252feaa1c319712b2d6577f8d | x_refsource_MISCPatchThird Party Advisory | |
| https://github.com/vyperlang/vyper/security/advisories/GHSA-4v9q-cgpw-cf38 | x_refsource_CONFIRMExploitMitigationThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2022-29255 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Jun 6, 2022
Updated Apr 22, 2025
Reserved Apr 13, 2022
Link CVE-2022-29255
CISA Vulnrichment
Updated Apr 22, 2025
ENISA EUVD
EUVD-2022-0356 GHSA-4V9Q-CGPW-CF38 Assigner GitHub_M
Published Jun 6, 2022
Updated Apr 22, 2025
Exploited since n/a
Link EUVD-2022-0356