Vulnerabilities > CVE-2022-29255 - Always-Incorrect Control Flow Implementation vulnerability in Vyperlang Vyper

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

vyperlang

CWE-670

NVD

Published: 2022-06-09

Updated: 2024-11-21

Summary

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.

Vulnerable Configurations

Part	Description	Count
Application	Vyperlang Vyperlang Vyper 0.0.4 Vyperlang Vyper 0.1.0 Vyperlang Vyper 0.2.0 Vyperlang Vyper 0.2.1 Vyperlang Vyper 0.2.2 Vyperlang Vyper 0.2.3 Vyperlang Vyper 0.2.4 Vyperlang Vyper 0.2.5 Vyperlang Vyper 0.2.6 Vyperlang Vyper 0.2.7 Vyperlang Vyper 0.2.8 Vyperlang Vyper 0.2.9 Vyperlang Vyper 0.2.10 Vyperlang Vyper 0.2.11 Vyperlang Vyper 0.2.12 Vyperlang Vyper 0.2.13 Vyperlang Vyper 0.2.14 Vyperlang Vyper 0.2.15 Vyperlang Vyper 0.2.16 Vyperlang Vyper 0.3.0 Vyperlang Vyper 0.3.1 Vyperlang Vyper 0.3.2 Vyperlang Vyper 0.3.3	39

Common Weakness Enumeration (CWE)

CWE-670 - Always-Incorrect Control Flow Implementation

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References