CVE-2022-24787: Incorrect Comparison

April 4, 2022 (updated August 2, 2023)

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with "\x00" because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are currently no known workarounds.

References

github.com/vyperlang/vyper/commit/2c73f8352635c0a433423a5b94740de1a118e508
github.com/vyperlang/vyper/security/advisories/GHSA-7vrm-3jc8-5wwm
nvd.nist.gov/vuln/detail/CVE-2022-24787

Code Behaviors & Features

Detect and mitigate CVE-2022-24787 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →