-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vyper | pip | < 0.3.8 | 0.3.8 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Vyper's codegen logic in versions <=0.3.7 where: 1) A global calldatasize check at contract entry (in module.py) was removed without proper per-function compensation 2) The default function's nonpayable check could be bypassed when called with <4 bytes of calldata. This was fixed by moving calldatasize checks to function-local contexts, particularly for 0-method-ID functions. The default function itself isn't inherently vulnerable, but the compiler's code generation for it in contracts with other nonpayable functions created unsafe conditions.