Summary
Vyper interfaces returning integer types less than 256 bits can be manipulated if uint256 is used
VVE-2020-0001
Earlier today, we received a responsible disclosure of a potential issue from @montyly (security researcher at @trailofbits) for Vyper users who make assumptions about what values certain interface types can return.
Workarounds
There is an easy workaround where you should check that the value returned by an interface which specifies uint8 should be checked to be within the bounds of a uint8 integer. As an example:
...
# returns uint8, but we implicitly cast to uint256 without checking
decimals: uint256 = ERC20(_token).decimal()
# FIX: Insert this line
assert decimals < 256
...
Depending on how you use this value, it may not be necessary to insert this check.
References
For more information
If you have any questions or comments about this advisory:
- Chat with us in our gitter
- Open an issue in https://github.com/vyperlang/vyper
- Email us at [email protected]
Impact
We determined the issue to be mild and unlikely to be exploited, with an easy workaround while the correct resolution is in process. The issue stems from a number of things, which we will detail here.
(1) The ABI Specification is under-defined such that function return type is not always reflected in how you use it
This means that a function which returns uint8 under the hood actually returns a 32 byte integer, making it identical to a function that returns uint256. This allows users to read an interface that returns a uint8 value to be stored into a uint256 variable without any explicit casting or input validation.
(2) Vyper doesn't have uint8 types
When Vyper was originally created, it only had one numeric type, but we added just enough types to be able to work with the majority of ERC interfaces that exist.
Unfortunately, we never added uint8, because it's only majority usage was for ERC20.decimals() as the return type, which isn't reflected in the method ID. Because of (1), it didn't matter that we didn't have these types implemented because you could capture the return value as uint256 and use it just fine.
(3) ERC20.decimals() returns uint8
ERC20.decimal() (which is an optional function) returns a uint8 type. While it was never intentioned to be used directly within a smart contract (hence being optional), someone could easily make the decision to rely on it to perform important functionality within their Vyper smart contract. This might lead to a scenario where an unexpectedly large value (> 255) returned by calling this function (which a malicious contract writer might write) would allow an attacker to manipulate or bypass certain logic depending on this value.
In summary, because of (1), it isn't necessary to have to cast the return value of a function that returns uint8 to uint256, and because of (2) it isn't possible to have the type system protect against this type of error. This could lead to scenarios like (3) where this behavior can be exploited.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
We are currently refactoring our typing system so we can implement all ABI-compliant integer types, but no currently patched version is available that gives users access to the uint8 type.
Frequently Asked Questions
- What is GHSA-MR6R-MVW4-736G? GHSA-MR6R-MVW4-736G is a low-severity security vulnerability in vyper (pip), affecting versions <= 0.1.0b16. No fixed version is listed yet.
- Which versions of vyper are affected by GHSA-MR6R-MVW4-736G? vyper (pip) versions <= 0.1.0b16 is affected.
- Is there a fix for GHSA-MR6R-MVW4-736G? No fixed version is listed for GHSA-MR6R-MVW4-736G yet. Monitor the advisory for updates and apply mitigations in the interim.
- Is GHSA-MR6R-MVW4-736G exploitable, and should I be worried? Whether GHSA-MR6R-MVW4-736G is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-MR6R-MVW4-736G is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.