Headline
CVE-2022-29175
Vyper is a pythonic smart contract language for the ethereum virtual machine. Since version 0.3.2, decimals use the full range of the underlying int168 type. multiplication of 168 bit integers can wrap in 256-bit arithmetic, but safemul does not check for that. This has been patched in v0.3.4. There are no known workarounds for this issue.
safemath for decimals do not check for 256-bit overflow
Affected versions
>=v0.3.2
Description
Impact
since v0.3.2, decimals use the full range of the underlying int168 type. multiplication of 168 bit integers can wrap in 256-bit arithmetic, but safemul does not check for that.
Patches****Workarounds****References
see #2845
For more information
If you have any questions or comments about this advisory:
- Open an issue in example link to repo
- Email us at example email address