CVE-2021-48019Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies

Descripción

Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-375m-5fvv-xq23) vendor-advisory
• VulnCheck Advisory: Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies third-party-advisory