Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.executebytecode call that triggers computation.stack.values with '"stack": [100, 100, 0]' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed indefinitely without gas being paid."
{ "nvd_published_at": null, "cwe_ids": [ "CWE-119" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-06-16T21:58:10Z" }