CVE-2023-46232

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-46232

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46232.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-46232

Aliases

GHSA-h8jv-969m-94r4

Published

2023-10-25T21:01:51.692Z

Modified

2025-12-05T00:09:15.575909Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

era-compiler-vyper First Immutable Variable Initialization vulnerability

Details

era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype version 1.3.10, a bug prevented the initialization of the first immutable variable for Vyper contracts meeting certain criteria. The problem arises when there is a String or Array with more 256-bit words allocated than initialized. It results in the second word’s index unset, that is effectively set to 0, so the first immutable value with the actual 0 index is overwritten in the ImmutableSimulator. Version 1.3.10 fixes this issue by setting all indexes in advance. The problem will go away, but it will get more expensive if the user allocates a lot of uninitialized space, e.g. String[4096]. Upgrading and redeploying affected contracts is the only way of working around the issue.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46232.json",
    "cwe_ids": [
        "CWE-471"
    ]
}

References

Affected packages

Git / github.com/matter-labs/era-compiler-vyper

Affected ranges

Type: GIT
Repo: https://github.com/matter-labs/era-compiler-vyper
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

8be305a1b9c68d0fd47dad3434224ed85944ca25

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46232.json"