https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 20:55:25 +0000 https://cve.radiocsirt.org/vuln/cve-2024-24567 <p><strong>Affected:</strong> vyperlang vyper</p> <p>Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the value= argument. If the semantics of the EVM are unknown to the developer, he could suspect that by specifying the `value` kwarg, exactly the given amount will be sent along to the target. This vulnerability affects 0.3.10 and earlier versions.</p> <p><strong>Affected:</strong> vyperlang vyper</p> <p>Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the value= argument. If the semantics of the EVM are unknown to the developer, he could suspect that by specifying the `value` kwarg, exactly the given amount will be sent along to the target. This vulnerability affects 0.3.10 and earlier versions.</p> https://cve.radiocsirt.org/vuln/cve-2024-24567 https://cve.radiocsirt.org/vuln/ghsa-x2c2-q32w-4w6m <p><strong>Affected:</strong> PyPI: vyper</p> <p>### Summary Vyper compiler allows passing a value in builtin `raw_call` even if the call is a `delegatecall` or a `staticcall`. But in the context of `delegatecall` and `staticcall` the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the `value=` argument.</p> <p>A contract search was performed and no vulnerable contracts were found in production.</p> <p>### Details The IR for `raw_call` is built in the `RawCall` class: https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/builtins/functions.py#L1100</p> <p>However, the compiler doesn&#39;t validate that if either `delegatecall` or `staticall` are provided as kwargs, that `value` wasn&#39;t set. For example, the following compiles without errors: ```python raw_call(self, call_data2, max_outsize=255, is_delegate_call=True, value=msg.value/2) ```</p> <p>### Impact If the semantics of the EVM are unknown to the developer, he could suspect that by specifying the `value` kwarg, exactly the given amount will be sent along to the target. However in fact, no `value` will be sent.</p> <p>Here is an example of an potentially problematic implementation of multicall utilizing the `raw_call` built-in: ```python value_accumulator: uint256 = empty(uint256) results: DynArray[Result, max_value(uint8)] = [] return_data: Bytes[max_value(uint8)] = b&#34;&#34; success: bool = empty(bool) for batch in data: msg_value: uint256 = batch.value value_accumulator = unsa…</p> <p><strong>Affected:</strong> PyPI: vyper</p> <p>### Summary Vyper compiler allows passing a value in builtin `raw_call` even if the call is a `delegatecall` or a `staticcall`. But in the context of `delegatecall` and `staticcall` the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the `value=` argument.</p> <p>A contract search was performed and no vulnerable contracts were found in production.</p> <p>### Details The IR for `raw_call` is built in the `RawCall` class: https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/builtins/functions.py#L1100</p> <p>However, the compiler doesn&#39;t validate that if either `delegatecall` or `staticall` are provided as kwargs, that `value` wasn&#39;t set. For example, the following compiles without errors: ```python raw_call(self, call_data2, max_outsize=255, is_delegate_call=True, value=msg.value/2) ```</p> <p>### Impact If the semantics of the EVM are unknown to the developer, he could suspect that by specifying the `value` kwarg, exactly the given amount will be sent along to the target. However in fact, no `value` will be sent.</p> <p>Here is an example of an potentially problematic implementation of multicall utilizing the `raw_call` built-in: ```python value_accumulator: uint256 = empty(uint256) results: DynArray[Result, max_value(uint8)] = [] return_data: Bytes[max_value(uint8)] = b&#34;&#34; success: bool = empty(bool) for batch in data: msg_value: uint256 = batch.value value_accumulator = unsa…</p> https://cve.radiocsirt.org/vuln/ghsa-x2c2-q32w-4w6m