CVE-2023-42441
18.09.2023, 21:16
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. This issue is fixed in version 0.3.10. As a workaround, ensure the lock name is a non-empty string.Enginsight| Vendor | Product | Version |
|---|---|---|
| vyperlang | vyper | 0.2.9 ≤ 𝑥 < 0.3.10 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-833 - DeadlockThe software contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
- CWE-667 - Improper LockingThe software does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
References