CVE-2023-41052: Vyper: incorrect order of evaluation of side effects for some builtins
Impact The order of evaluation of the arguments of the builtin functions uint256addmod, uint256mulmod, ecadd and ecmul does not follow source order. • For uint256addmod(a,b,c) and uint256mulmod(a,b,c), the order is c,a,b. • For ecadd(a,b) and ecmul(a,b), the order is b,a.
Note that this behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on.
Patches https://github.com/vyperlang/vyper/pull/3583
Workarounds When using builtins from the list above, make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.
References Are there any links users can visit to find out more?
Other sources
Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions uint256addmod, uint256mulmod, ecadd and ecmul does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-41052?
CVE-2023-41052 is a vulnerability in the Vyper smart contract language where the order of evaluation of certain builtin functions does not follow source order.
What is the impact of CVE-2023-41052?
The impact of CVE-2023-41052 is that the order of evaluation for certain builtin functions in Vyper is inconsistent, which can lead to unexpected behavior or vulnerabilities in smart contracts.
How can I fix CVE-2023-41052?
To fix CVE-2023-41052, update to Vyper version 0.3.10 or later.
What is the severity of CVE-2023-41052?
CVE-2023-41052 has a severity rating of 5.3, which is considered medium severity.
What is the CWE ID of CVE-2023-41052?
The CWE ID of CVE-2023-41052 is 670.