CVE-2023-32058

Overflow vulnerability in Vyper (before version 0.3.8)

• CVSS 7.5
• CWE-190: Integer Overflow or Wraparound
• Numeric Errors
• Remote

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. The issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable. The problem has been patched in version 0.3.8.

CVE

CVE-2023-32058

CWE

CWE-190: Integer Overflow or Wraparound

CVSS base score

7.5

Published

2023-05-11

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Algorithm

Code defect classification

Missing Algorithm

Category

Numeric Errors

Subcategory

Integer Overflows

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to Vyper version 0.3.8 or higher

@external
@pure
def function(a: uint256, N: uint256) -> uint256:
    """Vulnerable function that demonstrates the security issue."""
    total: uint256 = 0
    i: uint256 = 0

    for i in range(N):
        total += a + i

    return total

@external
@pure
def fixed_function(a: uint256, N: uint256) -> uint256:
    """Secure function that fixes the vulnerability."""
    assert N <= 2**256 - 1 - a
    total: uint256 = 0
    for i in range(N):
        total += a + i
    return total

@misc{vaitp:cve202332058,
  title        = {{Overflow vulnerability in Vyper (before version 0.3.8)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-32058},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-32058/}}
}