Skip to main content

Function Call With Incorrect Order of Arguments

CVE-2023-32059

High
7.5/10

Summary

Vyper package is a Pythonic smart contract language for the Ethereum virtual machine. In versions prior to 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible, typechecking is bypassed. The ability to pass kwargs to internal functions is an undocumented feature that is not well known about.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-683 - Function Call With Incorrect Order of Arguments

The software calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.

References

Advisory Timeline

  • Published