CVE-2024-43366 - CVE House

Back to Database

Status published High CVE-2024-43366

zkvyper ignored loop range bounds

7.5 CVSS

Vulnerability Description

zkvyper is a Vyper compiler. Starting in version 1.3.12 and prior to version 1.5.3, since LLL IR has no Turing-incompletness restrictions, it is compiled to a loop with a much more late exit condition. It leads to a loss of funds or other unwanted behavior if the loop body contains it. However, more real-life use cases like iterating over an array are not affected. No contracts were affected by this issue, which was fixed in version 1.5.3. Upgrading and redeploying affected contracts is the only way to avoid the vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-43366

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://github.com/matter-labs/era-compiler-vyper/security/advisories/GHSA-8j77-7rrv-6pxx

More from matter-labs

View All →

`fold (xor (shl 1, x), -1) -> (rotl ~1, x)` misoptimization in zksolc

ZKsync Era invalid stack addressing conversion

ZKsync Era evaluation order of Yul function arguments

era-compiler-solidity contains a `xor(zext(cmp), -1)` misoptimization

era-compiler-vyper First Immutable Variable Initialization vulnerability

Affected Vendor

matter-labs

View all reports →

Affected Software

era-compiler-vyper

Vulnerable Versions:

>= 1.3.12, < 1.5.3

Timeline

Official Publish: August 15th, 2024

Last Modified: August 16th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1562 Impair Defenses

Defense Evasion

T1485 Data Destruction