GHSA-ph9x-4vc9-m39g: Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls

Impact

Internal calls to internal functions with more than 1 default argument are compiled incorrectly. Depending on the number of arguments
provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible,
typechecking is bypassed. In the bar() function in the following code, self.foo(13) is compiled to
self.foo(13,12) instead of self.foo(13,1337).

@internal def foo(a:uint256 = 12, b:uint256 = 1337): pass

@internal def bar(): self.foo(13)

note that the ability to pass kwargs to internal functions is an undocumented feature that is not well known about.

Patches

Has the problem been patched? What versions should users upgrade to?
The problem is patched at vyperlang/vyper@c3e68c3

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Are there any links users can visit to find out more?

References

• GHSA-ph9x-4vc9-m39g
• https://nvd.nist.gov/vuln/detail/CVE-2023-32059
• vyperlang/vyper@c3e68c3