CVE-2024-43366CWE-835

zkvyper ignored loop range bounds

High · published August 15, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

zkvyper is a Vyper compiler. Starting in version 1.3.12 and prior to version 1.5.3, since LLL IR has no Turing-incompletness restrictions, it is compiled to a loop with a much more late exit condition. It leads to a loss of funds or other unwanted behavior if the loop body contains it. However, more real-life use cases like iterating over an array are not affected. No contracts were affected by this issue, which was fixed in version 1.5.3. Upgrading and redeploying affected contracts is the only way to avoid the vulnerability.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00511 · 42.7th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2024-08-15T20:11Z
EPSS history
Timeline
  • 15 AUG 20:11Z
    zkvyper ignored loop range bounds
    cvelistv5