CVE-2022-29255: Multiple evaluation of contract address in call in vyper
Impact when a calling an external contract with no return value, the contract address could be evaluated twice. this is usually only an efficiency problem, but if evaluation of the contract address has side effects, it could result in double evaluation of the side effects.
in the following example, Foo(msg.sender).bar() is the contract address for the following call (to .foo()), and could get evaluated twice
vyper interface Foo: def foo(): nonpayable def bar() -> address: nonpayable
@external def dostuff(): Foo(Foo(msg.sender).bar()).foo()
Patches 6b4d8ff185de071252feaa1c319712b2d6577f8d
Workarounds assign contract addresses to variables. the above example would change to vyper @external def dostuff(): t: Foo = Foo(msg.sender).bar() t.foo()
References
For more information
Other sources
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-29255?
CVE-2022-29255 is a vulnerability in the Vyper smart contract language that can result in double evaluation of side effects when calling an external contract with no return value.
What is the severity of CVE-2022-29255?
The severity of CVE-2022-29255 is high, with a CVSS score of 7.5.
Which software versions are affected by CVE-2022-29255?
Versions prior to 0.3.4 of the Vyper smart contract language are affected by CVE-2022-29255.
How can I fix CVE-2022-29255?
To fix CVE-2022-29255, update to version 0.3.4 or later of the Vyper smart contract language.
Where can I find more information about CVE-2022-29255?
More information about CVE-2022-29255 can be found in the references: [GitHub Commit](https://github.com/vyperlang/vyper/commit/6b4d8ff185de071252feaa1c319712b2d6577f8d), [GitHub Security Advisory](https://github.com/vyperlang/vyper/security/advisories/GHSA-4v9q-cgpw-cf38), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-29255).