GHSA-ppx5-q359-pvwj

Suggest an improvement
Source
https://github.com/advisories/GHSA-ppx5-q359-pvwj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-ppx5-q359-pvwj/GHSA-ppx5-q359-pvwj.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-ppx5-q359-pvwj
Aliases
Related
Published
2024-04-25T19:53:43Z
Modified
2025-05-05T19:57:12.687294Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
vyper's range(start, start + N) reverts for negative numbers
Details

Summary

When looping over a range of the form range(start, start + N), if start is negative, the execution will always revert.

Details

This issue is caused by an incorrect assertion inserted by the code generation of the range (stmt.parse_For_range()):

https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/codegen/stmt.py#L286-L287

This assertion was introduced in https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868 to fix https://github.com/advisories/GHSA-6r8q-pfpv-7cgj. The issue arises when start is signed, instead of using sle, le is used and start is interpreted as an unsigned integer for the comparison. If it is a negative number, its 255th bit is set to 1 and is hence interpreted as a very large unsigned integer making the assertion always fail.

PoC

@external
def foo():
    x:int256 = min_value(int256)
    # revert when it should not since we have the following assertion that fails:
    # [assert, [le, min_value(int256), max_value(int256) + 1 - 10]],
    for i in range(x, x + 10):
        pass

Patches

patched in v0.4.0, specifically, https://github.com/vyperlang/vyper/pull/3679 disallows this form of range().

Impact

Any contract having a range(start, start + N) where start is a signed integer with the possibility for start to be negative is affected. If a call goes through the loop while supplying a negative start the execution will revert.

Database specific
{
    "nvd_published_at": "2024-04-25T17:15:50Z",
    "cwe_ids": [
        "CWE-681"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-25T19:53:43Z"
}
References

Affected packages

PyPI / vyper

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.3.8
Fixed
0.4.0

Affected versions

0.*

0.3.8
0.3.9
0.3.10rc1
0.3.10rc2
0.3.10rc3
0.3.10rc4
0.3.10rc5
0.3.10
0.4.0b1
0.4.0b2
0.4.0b3
0.4.0b4
0.4.0b5
0.4.0b6
0.4.0rc1
0.4.0rc2