Podatność CVE-2023-42460


Publikacja: 2023-09-27

Opis:
Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not validate input when it is nested in an expression. Uses of `_abi_decode()` can be constructed which allow for bounds checking to be bypassed resulting in incorrect results. This issue has not yet been fixed, but a fix is expected in release `0.3.10`. Users are advised to reference pull request #3626.

Typ:

CWE-682

(Incorrect Calculation)

 Referencje:
https://github.com/vyperlang/vyper/security/advisories/GHSA-cx2q-hfxr-rj97
https://github.com/vyperlang/vyper/pull/3626

Copyright 2024, cxsecurity.com

 

Back to Top