4.3

CVE-2021-41122

Exploit

Bounds check missing for decimal args in Vyper

Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly validate the bounds of decimal arguments. The can lead to logic errors. This issue has been resolved in version 0.3.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Vyperlang ≫ Vyper Version < 0.3.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.78% 0.51
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:P/A:N
security-advisories@github.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-682 Incorrect Calculation

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

https://github.com/vyperlang/vyper/pull/2447
Third Party Advisory
https://github.com/vyperlang/vyper/security/advisories/GHSA-c7pr-343r-5c46
Third Party Advisory
Exploit