CVE-2023-32675 Nonpayable default functions are sometimes payable in vyper

What is CVE-2023-32675?

CVE-2023-32675 is a low-severity vulnerability in vyperlang vyper, published on 19 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the removal of the global `calldatasize` check in commit `02339dfda`. Users are advised to upgrade to version 0.3.8. Users unable to upgrade should avoid use of nonpayable default functions.

Weakness: CWE-670

Which versions are affected by CVE-2023-32675?

3 open source packages ship an affected version, including vyper. It affects 1 product.

Products include Vyperlang Vyper.

How do I fix CVE-2023-32675?

Upgrade vyper to 0.3.8 or later.

Is CVE-2023-32675 being exploited?

There is no known exploitation of CVE-2023-32675 in the wild and no public exploit code.

Other vulnerabilities in vyperlang vyper

• CVE-2024-24563 Vyper array negative index vulnerability Critical 9.8
• CVE-2024-24561 Vyper bounds check on built-in `slice()` function can be overflowed Critical 9.8
• CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks Critical 9.1
• CVE-2022-24845 Integer bounds error in Vyper High 8.8
• CVE-2022-29255 Multiple evaluation of contract address in call in vyper High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vxmm-cwh2-q762, PYSEC-2023-80.