CVE-2022-29255CWE-670

Multiple evaluation of contract address in call in vyper

High · published June 6, 2022

CVSS v3.1
8.2
EPSS
1%
Percentile
70.8
In the wild
Unconfirmed
What it is

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.01328 · 70.8th percentile
Weakness
CWE-670 · Always-Incorrect Control Flow Implementation
Published
2022-06-06T19:55Z
EPSS history
Timeline
  • 06 JUN 19:55Z
    Multiple evaluation of contract address in call in vyper
    cvelistv5