-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vyper | pip | >= 0.3.4, < 0.3.10 | 0.3.10 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from _abi_decode's output not being automatically validated via make_setter when used in nested expressions. The patch in PR #3626 explicitly adds validation by calling make_setter within ABIDecode(), confirming the function's direct involvement. The vulnerability manifests when decoded values are used in calculations without validation, aligning with CWE-682 (Incorrect Calculation). The file path is confirmed through the coverage diff in the pull request showing changes to vyper/builtins/functions.py.