CVE-2022-24845: Integer bounds error in Vyper
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of <iface>.returnsint128() is not validated to fall within the bounds of int128. This issue can result in a misinterpretation of the integer value and lead to incorrect behavior. As of v0.3.0, <iface>.returnsint128() is validated in simple expressions, but not complex expressions. Users are advised to upgrade. There is no known workaround for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-24845?
CVE-2022-24845 is a vulnerability in the Vyper smart contract language for the Ethereum virtual machine.
What is the severity of CVE-2022-24845?
CVE-2022-24845 has a severity rating of 9.8 (critical).
How does CVE-2022-24845 affect Vyper?
CVE-2022-24845 affects versions up to and excluding 0.3.2 of Vyper.
What is the impact of CVE-2022-24845?
CVE-2022-24845 can lead to a misinterpretation of integer values and cause incorrect behavior in Vyper.
How can CVE-2022-24845 be fixed?
The issue has been fixed in the commit 049dbdc647b2ce838fae7c188e6bb09cf16e470b in the Vyper repository.