Medium severity · published Oct 5, 2021
CVE-2021-41122
Vyper is a Pythonic Smart Contract Language for the EVM
4.3
CVSS
0.8%
EPSS
No
On KEV
Description
Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly validate the bounds of decimal arguments. The can lead to logic errors. This issue has been resolved in version 0.3.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VY
Vyper · Vyperlang
before 0.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41122
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41122
Third Party Advisory
https://github.com/vyperlang/vyper/pull/2447
Exploit
https://github.com/vyperlang/vyper/security/advisories/GHSA-c7pr-343r-5c46
More from Vyper
9.8
CVE-2024-24563
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine
9.8
CVE-2024-24561
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
9.8
CVE-2024-22419
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine
9.8
CVE-2022-24845
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
9.8
CVE-2022-24788
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine