CVE-2023-46232
CVSS 3.1 Score 5.3 of 10 (medium)
Details
Summary
CVE-2023-46232 is a vulnerability affecting era-compiler-vyper, the EraVM Vyper compiler for zkSync Era, a layer 2 rollup using zero-knowledge proofs to scale Ethereum. The bug occurs in versions prior to 1.3.10 and prevents the initialization of the first immutable variable for Vyper contracts meeting specific criteria. The issue arises when there is a String or Array with more allocated 256-bit words than initialized, resulting in the second word's index being unset and effectively set to 0. This overwrites the first immutable value in the ImmutableSimulator. Upgrading and redeploying affected contracts is the recommended solution, as it fixes the problem by setting all indexes in advance. While this vulnerability poses a medium risk with low integrity impact and no confidentiality impact, it can potentially be exploited over a network without requiring any privileges or user interaction.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions