Executive brief
Vyper is a smart contract programming language for Ethereum. The compiler incorrectly evaluates arguments to certain mathematical and cryptographic functions (uint256_addmod, uint256_mulmod, ecadd, ecmul) in a non-standard order that violates source semantics. When function arguments produce side effects (such as state changes or external calls), the reordered evaluation can cause dependent arguments to receive stale or incorrect values, leading to smart contracts behaving differently than their source code appears to indicate.
Technical details
This vulnerability is a compiler bug in Vyper's code generation for four builtin functions. For uint256_addmod(a,b,c) and uint256_mulmod(a,b,c), the compiler evaluates arguments in order c,a,b instead of a,b,c. For ecadd(a,b) and ecmul(a,b), it evaluates b,a instead of a,b. This violates the expected left-to-right evaluation order defined in the Vyper specification. The issue manifests as problematic behavior when arguments with side effects (state mutations, external contract calls) are used and subsequent arguments depend on those side effects. An attacker could craft a contract that exploits this reordering to manipulate the logic of vulnerable contracts. The vulnerability affects all Vyper versions before 0.3.10, and is patched in version 0.3.10 via PR #3583.
Affected products
- Vyper Vyper < 0.3.10
Timeline
- 2023-09-04: disclosed
- 2023-09-04: patched: Version 0.3.10 released with fix via PR #3583