Headline
CVE-2023-32059: Merge pull request from GHSA-ph9x-4vc9-m39g · vyperlang/vyper@c3e68c3
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible, typechecking is bypassed. The ability to pass kwargs to internal functions is an undocumented feature that is not well known about. The issue is patched in version 0.3.8.
@@ -1,6 +1,9 @@ import string from decimal import Decimal
import hypothesis.strategies as st import pytest from hypothesis import given, settings
from vyper.compiler import compile_code from vyper.exceptions import ArgumentException, CallViolation Expand Down Expand Up @@ -642,3 +645,62 @@ def bar() -> String[6]: c = get_contract_with_gas_estimation(contract)
assert c.bar() == “hello”
# TODO probably want to refactor these into general test utils st_uint256 = st.integers(min_value=0, max_value=2**256 - 1) st_string65 = st.text(max_size=65, alphabet=string.printable) st_bytes65 = st.binary(max_size=65) st_sarray3 = st.lists(st_uint256, min_size=3, max_size=3) st_darray3 = st.lists(st_uint256, max_size=3)
internal_call_kwargs_cases = [ ("uint256", st_uint256), ("String[65]", st_string65), ("Bytes[65]", st_bytes65), ("uint256[3]", st_sarray3), ("DynArray[uint256, 3]", st_darray3), ]
@pytest.mark.parametrize("typ1,strategy1", internal_call_kwargs_cases) @pytest.mark.parametrize(“typ2,strategy2", internal_call_kwargs_cases) def test_internal_call_kwargs(get_contract, typ1, strategy1, typ2, strategy2): # GHSA-ph9x-4vc9-m39g
@given(kwarg1=strategy1, default1=strategy1, kwarg2=strategy2, default2=strategy2) @settings(deadline=None, max_examples=5) # len(cases) * len(cases) * 5 * 5 def fuzz(kwarg1, kwarg2, default1, default2): code = f""” @internal def foo(a: {typ1} = {repr(default1)}, b: {typ2} = {repr(default2)}) -> ({typ1}, {typ2}): return a, b @external def test0() -> ({typ1}, {typ2}): return self.foo() @external def test1() -> ({typ1}, {typ2}): return self.foo({repr(kwarg1)}) @external def test2() -> ({typ1}, {typ2}): return self.foo({repr(kwarg1)}, {repr(kwarg2)}) @external def test3(x1: {typ1}) -> ({typ1}, {typ2}): return self.foo(x1) @external def test4(x1: {typ1}, x2: {typ2}) -> ({typ1}, {typ2}): return self.foo(x1, x2) “"” c = get_contract(code) assert c.test0() == [default1, default2] assert c.test1() == [kwarg1, default2] assert c.test2() == [kwarg1, kwarg2] assert c.test3(kwarg1) == [kwarg1, default2] assert c.test4(kwarg1, kwarg2) == [kwarg1, kwarg2]
fuzz()
Related news
### Impact Internal calls to internal functions with more than 1 default argument are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible, typechecking is bypassed. In the `bar()` function in the following code, `self.foo(13)` is compiled to `self.foo(13,12)` instead of `self.foo(13,1337)`. ```vyper @internal def foo(a:uint256 = 12, b:uint256 = 1337): pass @internal def bar(): self.foo(13) ``` note that the ability to pass kwargs to internal functions is an undocumented feature that is not well known about. ### Patches _Has the problem been patched? What versions should users upgrade to?_ The problem is patched at https://github.com/vyperlang/vyper/commit/c3e68c302aa6e1429946473769dd1232145822ac ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ ### References _Are there any links users can visit to find ...