id: PYSEC-2023-78
details: Vyper is a Pythonic smart contract language for the Ethereum virtual machine.
  Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning
  the iterator of a loop to a variable, it is possible to overflow the type of the
  latter. The issue seems to happen only in loops of type `for i in range(a, a + N)`
  as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the
  compiler is able to raise a `TypeMismatch` when trying to overflow the variable.
  The problem has been patched in version 0.3.8.
affected:
- package:
    name: vyper
    ecosystem: PyPI
    purl: pkg:pypi/vyper
  ranges:
  - type: GIT
    repo: https://github.com/vyperlang/vyper
    events:
    - introduced: "0"
    - fixed: 3de1415ee77a9244eb04bdb695e249d3ec9ed868
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.3.8
  versions:
  - 0.1.0b1
  - 0.1.0b10
  - 0.1.0b11
  - 0.1.0b12
  - 0.1.0b13
  - 0.1.0b14
  - 0.1.0b15
  - 0.1.0b16
  - 0.1.0b17
  - 0.1.0b2
  - 0.1.0b3
  - 0.1.0b4
  - 0.1.0b5
  - 0.1.0b6
  - 0.1.0b7
  - 0.1.0b8
  - 0.1.0b9
  - 0.2.1
  - 0.2.10
  - 0.2.11
  - 0.2.12
  - 0.2.13
  - 0.2.14
  - 0.2.15
  - 0.2.16
  - 0.2.2
  - 0.2.3
  - 0.2.4
  - 0.2.5
  - 0.2.6
  - 0.2.7
  - 0.2.8
  - 0.2.9
  - 0.3.0
  - 0.3.1
  - 0.3.2
  - 0.3.3
  - 0.3.4
  - 0.3.5
  - 0.3.6
  - 0.3.7
references:
- type: EVIDENCE
  url: https://github.com/vyperlang/vyper/security/advisories/GHSA-6r8q-pfpv-7cgj
- type: ADVISORY
  url: https://github.com/vyperlang/vyper/security/advisories/GHSA-6r8q-pfpv-7cgj
- type: FIX
  url: https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868
aliases:
- CVE-2023-32058
- GHSA-6r8q-pfpv-7cgj
modified: "2023-06-05T01:13:02.949990Z"
published: "2023-05-11T21:15:00Z"