CVE-2023-32675 json
Nonpayable default functions are sometimes payable in vyper
published 2023-05-19 3 y ago modified 2026-06-17 4 mo ago also GHSA-vxmm-cwh2-q762 , PYSEC-2023-80 , EUVD-2023-0273
- cvss
- 3.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the removal of the global `calldatasize` check in commit `02339dfda`. Users are advised to upgrade to version 0.3.8. Users unable to upgrade should avoid use of nonpayable default functions.
Patch / fix
- pypi vyper 0.3.8
- vyperlang vyper 0.3.8
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/vyperlang/vyper/security/advisories/GHSA-vxmm-cwh2-q762 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | vyper | <0.3.8 |
0.3.8 |
Affected products
- vyperlang vyper
Classification
- Weakness
-
- CWE-670 Always-Incorrect Control Flow Implementation
References
-
github.com
/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520
web, patch
-
github.com
/vyperlang/vyper/security/advisories/GHSA-vxmm-cwh2-q762
web, exploit, patch, vendor-advisory, evidence, advisory
-
github.com
/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520.
web, patch
-
github.com
/vyperlang/vyper/commit/903727006c1e5ebef99fa9fd5d51d62bd33d72a9
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-32675
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-80.yaml
web
-
github.com
/vyperlang/vyper
package
Sources
- CVE List CVE-2023-32675
- GitHub Advisory GHSA-vxmm-cwh2-q762
- NVD CVE-2023-32675
- OSV PYSEC-2023-80
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.