CVE-2022-29255 Multiple evaluation of contract address in call in vyper
Vyper compiler flaw causes double evaluation of contract addresses, leading to incorrect smart contract execution outcomes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-29255?
CVE-2022-29255 is a high-severity vulnerability in vyperlang vyper, published on 6 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.
Weakness: CWE-670
Which versions are affected by CVE-2022-29255?
3 open source packages ship an affected version, including vyper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vyper PyPI | All versions | 0.3.4 |
vyper PyPI | All versions | 0.3.4 |
vyper PyPI | All versions | 0.3.4 |
Products include Vyperlang Vyper.
How do I fix CVE-2022-29255?
Upgrade vyper to 0.3.4 or later.
Is CVE-2022-29255 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-29255 exists.
Other vulnerabilities in vyperlang vyper
- CVE-2024-24563 Vyper array negative index vulnerability
- CVE-2024-24561 Vyper bounds check on built-in `slice()` function can be overflowed
- CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks
- CVE-2022-24845 Integer bounds error in Vyper
- CVE-2023-42443 Vyper vulnerable to memory corruption in certain builtins utilizing `msize`
Sources
Also known as GHSA-4v9q-cgpw-cf38, PYSEC-2022-43053.