Vyper Smart Contract Nonreentrant Lock Storage Corruption

Executive Summary

This vulnerability affects Vyper versions 0.2.13 to 0.2.14. The @nonreentrant decorator, meant to prevent reentrancy attacks, has a flaw where storage slots for reentrancy locks overlap with contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking intended logic.

Useful 0 Not Useful 0

Detection Guidance

Check Vyper version in use with 'vyper --version'. If it is between 0.2.13 and 0.2.14 inclusive, the system is vulnerable. Inspect smart contracts for use of the @nonreentrant decorator in affected versions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to severe operational failures in smart contracts. It may cause unintended behavior, data corruption, or security breaches due to the overwriting of critical storage variables. Contracts relying on @nonreentrant for security could become vulnerable to attacks or malfunction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts smart contracts written in Vyper, leading to storage corruption and unintended behavior. It does not directly affect compliance with GDPR or HIPAA, as those standards focus on data protection and privacy rather than smart contract security. However, if the affected contracts handle personal or health data, the resulting operational failures could indirectly lead to non-compliance due to data breaches or loss of integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Vyper to version 0.2.15 or later. Avoid using the @nonreentrant decorator in versions 0.2.13 to 0.2.14 as a temporary measure.

Useful 0 Not Useful 0