CVE-2023-37902
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Vyper is a Pythonic programming language targeting the Ethereum Virtual Machine (EVM). Prior to version 0.3.10, the ecrecover precompile did not fill the output buffer if the signature did not verify, potentially leading to false signature verification results.
Risk Assessment
Organizations may be at risk of accepting invalid signatures, which could lead to unauthorized access or data manipulation. Exploiting this vulnerability could result in significant financial and reputational consequences.
Recommendation
It is recommended to update Vyper to version 0.3.10 or later to patch this vulnerability. Additionally, conducting a code audit to identify potential areas where this flaw may occur is advisable.
Original NVD description (English source)
Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM). Prior to version 0.3.10, the ecrecover precompile does not fill the output buffer if the signature does not verify. However, the ecrecover builtin will still return whatever is at memory location 0. This means that the if the compiler has been convinced to write to the 0 memory location with specially crafted data (generally, this can happen with a hashmap access or immutable read) just before the ecrecover, a signature check might pass on an invalid signature. Version 0.3.10 contains a patch for this issue.