High severity · published May 8, 2023
CVE-2023-30837
Vyper is a pythonic smart contract language for the EVM
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VY
Vyper · Vyperlang
before 0.3.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-30837
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-30837
Patch
https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bb
Exploit
https://github.com/vyperlang/vyper/security/advisories/GHSA-mgv8-gggw-mrg6
More from Vyper
9.8
CVE-2024-24563
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine
9.8
CVE-2024-24561
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
9.8
CVE-2024-22419
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine
9.8
CVE-2022-24845
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
9.8
CVE-2022-24788
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine