Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls

CVE-2023-32059

What is CVE-2023-32059?

The Vyper smart contract language for Ethereum has a vulnerability in how it handles internal calls with default arguments in versions prior to 0.3.8. Specifically, the compilation of these calls occurs incorrectly; the default arguments are added from left-to-right instead of the expected right-to-left. This misalignment can lead to a bypass of type checking if incompatible types are passed. Furthermore, the handling of keyword arguments for internal functions is not well documented, introducing potential exploitation paths by developers unfamiliar with this feature. The issue has been resolved in Vyper version 0.3.8.

References