CVE-2023-46232

CVSS 3.1 Score 5.3 of 10 (medium)

Details

Published Oct 25, 2023
Updated: Nov 6, 2023
CWE ID 471

Summary

CVE-2023-46232 is a vulnerability affecting era-compiler-vyper, the EraVM Vyper compiler for zkSync Era, a layer 2 rollup using zero-knowledge proofs to scale Ethereum. The bug occurs in versions prior to 1.3.10 and prevents the initialization of the first immutable variable for Vyper contracts meeting specific criteria. The issue arises when there is a String or Array with more allocated 256-bit words than initialized, resulting in the second word's index being unset and effectively set to 0. This overwrites the first immutable value in the ImmutableSimulator. Upgrading and redeploying affected contracts is the recommended solution, as it fixes the problem by setting all indexes in advance. While this vulnerability poses a medium risk with low integrity impact and no confidentiality impact, it can potentially be exploited over a network without requiring any privileges or user interaction.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-46232 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options