CVE-2022-29255: Multiple evaluation of contract address in call in vyper
First published: Mon Jun 06 2022(Updated: )
### Impact when a calling an external contract with no return value, the contract address could be evaluated twice. this is usually only an efficiency problem, but if evaluation of the contract address has side effects, it could result in double evaluation of the side effects. in the following example, `Foo(msg.sender).bar()` is the contract address for the following call (to `.foo()`), and could get evaluated twice ```vyper interface Foo: def foo(): nonpayable def bar() -> address: nonpayable @external def do_stuff(): Foo(Foo(msg.sender).bar()).foo() ``` ### Patches 6b4d8ff185de071252feaa1c319712b2d6577f8d ### Workarounds assign contract addresses to variables. the above example would change to ```vyper @external def do_stuff(): t: Foo = Foo(msg.sender).bar() t.foo() ``` ### References ### For more information
Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/vyper | <0.3.4 | 0.3.4 |
| Vyperlang Vyper | <0.3.4 | |
| <0.3.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/vyperlang/vyper/security/advisories/GHSA-4v9q-cgpw-cf38
- https://github.com/vyperlang/vyper/commit/6b4d8ff185de071252feaa1c319712b2d6577f8d
- https://nvd.nist.gov/vuln/detail/CVE-2022-29255
- https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2022-43053.yaml
- https://github.com/advisories/GHSA-4v9q-cgpw-cf38 (Advisory)
Frequently Asked Questions
What is CVE-2022-29255?
CVE-2022-29255 is a vulnerability in the Vyper smart contract language that can result in double evaluation of side effects when calling an external contract with no return value.
What is the severity of CVE-2022-29255?
The severity of CVE-2022-29255 is high, with a CVSS score of 7.5.
Which software versions are affected by CVE-2022-29255?
Versions prior to 0.3.4 of the Vyper smart contract language are affected by CVE-2022-29255.
How can I fix CVE-2022-29255?
To fix CVE-2022-29255, update to version 0.3.4 or later of the Vyper smart contract language.
Where can I find more information about CVE-2022-29255?
More information about CVE-2022-29255 can be found in the references: [GitHub Commit](https://github.com/vyperlang/vyper/commit/6b4d8ff185de071252feaa1c319712b2d6577f8d), [GitHub Security Advisory](https://github.com/vyperlang/vyper/security/advisories/GHSA-4v9q-cgpw-cf38), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-29255).
- collector/nvd-index
- agent/type
- agent/author
- agent/weakness
- agent/references
- agent/remedy
- agent/description
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-4v9q-cgpw-cf38
- alias/CVE-2022-29255
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- agent/event
- collector/github-advisory
- agent/tags
- agent/trending
- vendor/vyperlang
- canonical/vyperlang vyper
- package-manager/pip