CVE-2021-48018: Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator
Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract's intended logic.
Affected Software
Event History
Frequently Asked Questions
Which contracts are exposed to this issue?
Contracts compiled with Vyper versions from 0.2.13 through versions before 0.2.15 are affected when they use the @nonreentrant decorator and have contract storage variables that overlap the lock's allocated storage slot.
What must happen for the contract state to be corrupted?
A function that uses @nonreentrant must be called. Setting its reentrancy lock can overwrite the overlapping storage variable, changing contract state and potentially breaking the intended contract logic.
Is an attacker required to have credentials or user interaction to trigger the issue?
No. The supplied vector indicates network access, no privileges, and no user interaction, although exploitation is rated as requiring high attack complexity.