Vyper: reversed order of side effects for some operations
Impact
For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right to left instead of left to right.
- unsafe_add
- unsafe_sub
- unsafe_mul
- unsafe_div
- pow_mod256
- |, &, ^ (bitwise operators)
- bitwise_or (deprecated)
- bitwise_and (deprecated)
- bitwise_xor (deprecated)
- raw_call
- <, >, <=, >=, ==, !=
- in, not in (when lhs and rhs are enums)This behaviour becomes a problem when the evaluation of one of the arguments produces side effects that other arguments depend on. The following expressions can produce side-effect:
- state modifying external call
- state modifying internal call
raw_callpop()when used on a Dynamic Array stored in the storagecreate_minimal_proxy_tocreate_copy_ofcreate_from_blueprint
For example:
f:uint256
@internal
def side_effect() -> uint256:
self.f = 12
return 1
@external
def foo() -> uint256:
return unsafe_add(self.f,self.side_effect()) # returns 13 instead of 1a:DynArray[uint256, 12]
@external
def bar() -> bool:
self.a = [1,2,3]
return len(self.a) == self.a.pop() # return false instead of truePatches
not yet patched, will address in a future release. tracking in https://github.com/vyperlang/vyper/issues/3604.
Workarounds
When using expressions from the list above, make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.
References
Are there any links users can visit to find out more?
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | vyper | <= 0.4.2 | sin corrección |
Referencias
- https://github.com/vyperlang/vyper/security/advisories/GHSA-g2xh-c426-v8mf
- https://nvd.nist.gov/vuln/detail/CVE-2023-40015
- https://github.com/vyperlang/vyper/issues/3604
- https://github.com/vyperlang/vyper/issues/4019
- https://github.com/vyperlang/vyper/pull/4157
- https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-167.yaml
- https://github.com/vyperlang/vyper
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N- Debilidad (CWE)
CWE-670- Plataforma
- Python (PyPI)
- Paquete
vyper- Publicada
- 04.09.2023
- Actualizado
- 11.10.2026 12:19
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2023-167 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-g2xh-c426-v8mf - CC BY 4.0
Historial de vulnerabilidades: vyper
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 47
- Primera → última
- 03.2020 10.2026
- Sin corrección
- 5
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 3
- Alta 14
- Media 20
- Baja 10
Divulgaciones por año
- 2020: 1
- 2021: 5
- 2022: 4
- 2023: 14
- 2024: 14
- 2025: 6
- 2026: 3
-
Vyper: reversed order of side effects for some operations esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.