CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks
Vyper compiler flaw allows cross-function re-entrancy attacks, enabling unauthorized state modification in smart contracts using specific non-reentrant patterns.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-39363?
CVE-2023-39363 is a critical vulnerability in vyperlang vyper, published on 7 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically: a `.vy` contract compiled with `vyper` versions `0.2.15`, `0.2.16`, or `0.3.0`; a primary function that utilizes the `@nonreentrant` decorator with a specific `key` and does not strictly follow the check-effects-interaction pattern (i.e. contains an external call to an untrusted party before storage updates); and a secondary function that utilizes the same `key` and would be affected by the improper state caused by the primary function. Version 0.3.1 contains a fix for this issue.
Weakness: CWE-863
Which versions are affected by CVE-2023-39363?
3 open source packages ship an affected version, including vyper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vyper PyPI | All versions | None |
vyper PyPI | From 0.2.15 | 0.3.1 |
vyper PyPI | From 0.2.15 | 0.3.1 |
Products include Vyperlang Vyper.
How do I fix CVE-2023-39363?
Upgrade vyper to 0.3.1 or later.
Is CVE-2023-39363 being exploited?
There is no known exploitation of CVE-2023-39363 in the wild and no public exploit code.
Other vulnerabilities in vyperlang vyper
- CVE-2024-24563 Vyper array negative index vulnerability
- CVE-2024-24561 Vyper bounds check on built-in `slice()` function can be overflowed
- CVE-2022-24845 Integer bounds error in Vyper
- CVE-2022-29255 Multiple evaluation of contract address in call in vyper
- CVE-2023-42443 Vyper vulnerable to memory corruption in certain builtins utilizing `msize`
Sources
Also known as GHSA-5824-cm3x-3c38, PYSEC-2023-142.