Listen to this Post
How the CVE Works
The vulnerability occurs in Vyper’s `concat()` function, which optimizes performance by skipping evaluation of arguments with zero-length bytestrings. This fastpath bypasses side effects in expressions generating empty bytestrings, such as those using ternary operators (b"" if condition else b""). For example, if `sideeffect()` modifies state (e.g., incrementing a counter), it may be ignored when the bytestring is empty. This behavior stems from the function’s early exit when encountering zero-length inputs:
Fastpath in Vyper's concat() if len(arg) == 0: continue Skips side-effect evaluation
DailyCVE Form
Platform: Vyper
Version: <0.3.8
Vulnerability: Side-effect skip
Severity: Low
Date: 2023-XX-XX
What Undercode Say:
Exploitation
- Trigger Condition: Use ternary ops with side effects in
concat().concat(b"" if self.update_state() else b"", b"data")
- Bypass Checks: Ensure first argument evaluates to
b"".
Protection
- Patch: Upgrade to Vyper >=0.3.8 (tracked in PR4644).
- Code Audit: Search for `concat()` with ternary args.
grep -r "concat(.if.else" ./contracts
3. Workaround: Replace ternary with explicit checks:
tmp: Bytes[bash] = b"" if self.sideeffect(): tmp = b"" concat(tmp, b"data")
Analytics
- Affected Contracts: Rare (low-severity due to uncommon patterns).
- Detection: Static analyzers can flag `concat()` + ternary combos.
References
- Vyper Issue: GitHub4644
- CVE Details: NVD Entry
No additional commentary beyond specified rules.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
