High severity · published Jun 9, 2022
CVE-2022-29255
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VY
Vyper · Vyperlang
before 0.3.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29255
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29255
Patch
https://github.com/vyperlang/vyper/commit/6b4d8ff185de071252feaa1c319712b2d6577f8d
Exploit
https://github.com/vyperlang/vyper/security/advisories/GHSA-4v9q-cgpw-cf38
More from Vyper
9.8
CVE-2024-24563
Vyper array negative index vulnerability
9.8
CVE-2024-24561
Vyper bounds check on built-in `slice()` function can be overflowed
9.8
CVE-2024-22419
concat built-in can corrupt memory in vyper
9.8
CVE-2022-24845
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
9.8
CVE-2022-24788
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine