Storage corruption due to variables overwritten by re-entrancy locks

GHSA-7f92-rr6w-cq64

Published Aug 5, 2021 · Modified Dec 2, 2024

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Background

When attempting to use the v0.2.14 release, @pandadefi discovered an issue using the @nonreentrant decorator.

Impact

Reentrancy protection storage slots get allocated to the same slots as storage variables, leading to the corruption of storage variables when using the @nonreentrant decorator.

Patches

This issue was fixed in v0.2.15 in #2391, #2379

Workarounds

Don't use the @nonreentrant decorator in these versions.

References

WEB https://github.com/vyperlang/vyper/security/advisories/GHSA-7f92-rr6w-cq64
WEB https://github.com/vyperlang/vyper/pull/2379
WEB https://github.com/vyperlang/vyper/pull/2391

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes