GHSA-7f92-rr6w-cq64

Source

https://github.com/advisories/GHSA-7f92-rr6w-cq64

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-7f92-rr6w-cq64/GHSA-7f92-rr6w-cq64.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-7f92-rr6w-cq64

Published

2021-08-05T16:57:42Z

Modified

2024-12-02T05:45:10.818149Z

Summary

Storage corruption due to variables overwritten by re-entrancy locks

Details

Background

When attempting to use the v0.2.14 release, @pandadefi discovered an issue using the @nonreentrant decorator.

Impact

Reentrancy protection storage slots get allocated to the same slots as storage variables, leading to the corruption of storage variables when using the @nonreentrant decorator.

Patches

This issue was fixed in v0.2.15 in #2391, #2379

Workarounds

Don't use the @nonreentrant decorator in these versions.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-02T19:12:30Z"
}

References

Affected packages

PyPI / vyper

Package

Name: vyper; View open source insights on deps.dev
Purl: pkg:pypi/vyper

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.2.13

Fixed

0.2.15

Affected versions

0.*

0.2.13

0.2.14