id: PYSEC-2024-246
modified: 2025-05-05T19:21:20.899426Z
published: 2024-04-25T17:15:50Z
aliases:
- CVE-2024-32481
- GHSA-ppx5-q359-pvwj
details: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.
  Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a `range`
  of the form `range(start, start + N)`, if `start` is negative, the execution will
  always revert. This issue is caused by an incorrect assertion inserted by the code
  generation of the range `stmt.parse_For_range()`. The issue arises when `start`
  is signed, instead of using `sle`, `le` is used and `start` is interpreted as an
  unsigned integer for the comparison. If it is a negative number, its 255th bit is
  set to `1` and is hence interpreted as a very large unsigned integer making the
  assertion always fail. Any contract having a `range(start, start + N)` where `start`
  is a signed integer with the possibility for `start` to be negative is affected.
  If a call goes through the loop while supplying a negative `start` the execution
  will revert. Version 0.4.0b1 fixes the issue.
affected:
- package:
    ecosystem: PyPI
    name: vyper
    purl: pkg:pypi/vyper
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 0.3.8
    - fixed: 0.4.0b1
  versions:
  - 0.3.10
  - 0.3.10rc1
  - 0.3.10rc2
  - 0.3.10rc3
  - 0.3.10rc4
  - 0.3.10rc5
  - 0.3.8
  - 0.3.9
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
references:
- type: ADVISORY
  url: https://github.com/vyperlang/vyper/security/advisories/GHSA-ppx5-q359-pvwj
- type: EVIDENCE
  url: https://github.com/vyperlang/vyper/security/advisories/GHSA-ppx5-q359-pvwj
- type: FIX
  url: 
    https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868
- type: FIX
  url: 
    https://github.com/vyperlang/vyper/commit/5319cfbe14951e007ccdb323257e5ada869b35d5
- type: WEB
  url: 
    https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/codegen/stmt.py#L286-L287
- type: ADVISORY
  url: https://github.com/advisories/GHSA-ppx5-q359-pvwj