CVE-2023-39363: Vyper has incorrectly allocated named re-entrancy locks
(updated )
In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically:
- A
.vycontract compiled with either of the followingvyperversions:0.2.15,0.2.16,0.3.0 - A primary function that utilizes the
@nonreentrantdecorator with a specifickeyand does not strictly follow the check-effects-interaction pattern (i.e. contains an external call to an untrusted party before storage updates) - A secondary function that utilizes the same
keyand would be affected by the improper state caused by the primary function
References
- github.com/advisories/GHSA-5824-cm3x-3c38
- github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-142.yaml
- github.com/vyperlang/vyper
- github.com/vyperlang/vyper/pull/2439
- github.com/vyperlang/vyper/pull/2514
- github.com/vyperlang/vyper/security/advisories/GHSA-5824-cm3x-3c38
- hackmd.io/@LlamaRisk/BJzSKHNjn
- hackmd.io/@vyperlang/HJUgNMhs2
- nvd.nist.gov/vuln/detail/CVE-2023-39363
Code Behaviors & Features
Detect and mitigate CVE-2023-39363 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →