CVE-2022-29255

Multiple evaluation of contract address in call in vyper

State: Published
Severity: 8.2 High
Published: Jun 6, 2022
Updated: Apr 22, 2025
Reserved: Apr 13, 2022

Description

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L	GitHub_M

Weaknesses

CWE-670 Always-Incorrect Control Flow Implementation

Affected Products

Product	Versions
vypervyperlang	< 0.3.4Affected

References

https://github.com/vyperlang/vyper/security/advisories/GHSA-4v9q-cgpw-cf38
https://github.com/vyperlang/vyper/commit/6b4d8ff185de071252feaa1c319712b2d6577f8d

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.