CVE-2022-24845: Integer Overflow or Wraparound

April 13, 2022 (updated August 2, 2023)

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of <iface>.returns_int128() is not validated to fall within the bounds of int128. This issue can result in a misinterpretation of the integer value and lead to incorrect behavior. As of v0.3.0, <iface>.returns_int128() is validated in simple expressions, but not complex expressions. Users are advised to upgrade. There is no known workaround for this issue.

References

github.com/advisories/GHSA-j2x6-9323-fp7h
github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470b
github.com/vyperlang/vyper/security/advisories/GHSA-j2x6-9323-fp7h
nvd.nist.gov/vuln/detail/CVE-2022-24845

Code Behaviors & Features

Detect and mitigate CVE-2022-24845 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →