CVE-2024-43366
zkvyper ignored loop range bounds
- State
- Published
- Severity
- 7.5 High
- Published
- Aug 15, 2024
- Updated
- Aug 16, 2024
- Reserved
- Aug 9, 2024
Description
zkvyper is a Vyper compiler. Starting in version 1.3.12 and prior to version 1.5.3, since LLL IR has no Turing-incompletness restrictions, it is compiled to a loop with a much more late exit condition. It leads to a loss of funds or other unwanted behavior if the loop body contains it. However, more real-life use cases like iterating over an array are not affected. No contracts were affected by this issue, which was fixed in version 1.5.3. Upgrading and redeploying affected contracts is the only way to avoid the vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | GitHub_M |
Weaknesses
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Affected Products
| Product | Versions |
|---|---|
era-compiler-vypermatter-labs |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.