CVE-2021-48019Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies

Beschreibung

Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-375m-5fvv-xq23) vendor-advisory
• VulnCheck Advisory: Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies third-party-advisory