CVE-2023-32675

Vyper default function nonpayable issue

• CVSS 5.3
• CWE-670
• Authentication, Authorization, and Session Management
• Remote

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the removal of the global `calldatasize` check in commit `02339dfda`. Users are advised to upgrade to version 0.3.8. Users unable to upgrade should avoid use of nonpayable default functions.

CVE

CVE-2023-32675

CWE

CWE-670

CVSS base score

5.3

Published

2023-05-19

OWASP

A04 Insecure Design

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Authentication, Authorization, and Session Management

Subcategory

Insecure Authentication Mechanisms

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update to Vyper version 0.3.8 or higher

@external
@nonpayable
def __default__():
    pass

@external
@nonpayable
def regular_function_one():
    pass

@external
@nonpayable
def regular_function_two():
    pass

@external
@nonpayable
def __default__():
    assert msg.value == 0, "This function does not accept Ether"

@external
@nonpayable
def regular_function_one():
    assert msg.value == 0, "This function does not accept Ether"
    

@external
@nonpayable
def regular_function_two():
    assert msg.value == 0, "This function does not accept Ether"

@misc{vaitp:cve202332675,
  title        = {{Vyper default function nonpayable issue}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-32675},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-32675/}}
}