Executive brief
Vyper is a smart contract programming language used to write code that runs on the Ethereum blockchain. A memory corruption vulnerability exists when developers use function calls inside array expressions, caused by an incorrect stack pointer. This can lead to memory corruption and potential code execution during contract compilation, affecting the integrity of deployed smart contracts.
Technical details
A memory corruption vulnerability (CWE-129) exists in Vyper's handling of function calls within arrays. The issue stems from an incorrect pointer to the stack tip during array element evaluation with nested function calls. This vulnerability was partially addressed in a prior fix (VVE-2020-0004) but similar vulnerable code patterns in array handling were missed. The flaw occurs at compile-time when processing Vyper source code; no runtime attack vector or authentication is required. An attacker controlling Vyper source code can trigger memory corruption during compilation, potentially leading to undefined behavior or malicious bytecode generation. The issue is fixed in Vyper version 0.2.12 and later (PR #2345).
Affected products
- Vyper Vyper before 0.2.12
Timeline
- 2021-04-19: disclosed: Advisory GHSA-22wc-c9wj-6q2v published
- 2021-04-11: patched: Fix merged in PR #2345; patched version 0.2.12 released