p PatchFirst

CVE-2020-37289

CVE-2020-37289 · Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values.

CVSS 6.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • vyper

    Versions
    • ≥ 0, < 0.3.1: Affected (python)
    • 0.3.1: Not affected (python)

    Update to 0.3.1

  • vyper PyPI

    Versions
    • 0.1.0b1
    • 0.1.0b10
    • 0.1.0b11
    • 0.1.0b12
    • 0.1.0b13
    • 0.1.0b14
    • 0.1.0b15
    • 0.1.0b16
    • 0.1.0b2
    • 0.1.0b3
    • 0.1.0b4
    • 0.1.0b5
    • 0.1.0b6
    • 0.1.0b7
    • 0.1.0b8
    • 0.1.0b9
    Affected ranges
    • ECOSYSTEM: ≤ 0.1.0b16

    No fix published

Original sources

Check your server →