CVE-2023-30629

Incorrect bytecode generation in Vyper (versions 0.3.1 through 0.3.7) for raw_call with specific parameters

• CVSS 7.5
• CWE-670
• Design Defects
• Remote

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the `raw_call` with `revert_on_failure=False` and `max_outsize=0` receives the wrong response from `raw_call`. Depending on the memory garbage, the result can be either `True` or `False`. A patch is available and, as of time of publication, anticipated to be part of Vyper 0.3.8. As a workaround, one may always put `max_outsize>0`.

CVE

CVE-2023-30629

CWE

CWE-670

CVSS base score

7.5

Published

2023-04-24

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Design Defects

Subcategory

Inadequate Error Handling

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update to Vyper version 0.3.8 or higher

@external
@payable
def call_external(addr: address):
    """Vulnerable function that demonstrates the security issue."""
    success: bool = raw_call(
        addr,
        b"",
        revert_on_failure=False,
        max_outsize=0
    )
    assert success, "External call failed"

@external
@payable
def call_external(addr: address):
    """Secure function that fixes the vulnerability."""
    success: bool = raw_call(
        addr,
        b"",
        max_outsize=1,
        revert_on_failure=True
    )
    assert success, "External call failed"

@misc{vaitp:cve202330629,
  title        = {{Incorrect bytecode generation in Vyper (versions 0.3.1 through 0.3.7) for raw_call with specific parameters}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-30629},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-30629/}}
}