CVE-2023-40015

Vyper is a Pythonic Smart Contract Language. For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right to left instead of left to right. `unsafe_add, unsafe_sub, unsafe_mul, unsafe_div, pow_mod256, |, &, ^ (bitwise operators), bitwise_or (deprecated), bitwise_and (deprecated), bitwise_xor (deprecated), raw_call, <, >, <=, >=, ==, !=, in, not in (when lhs and rhs are enums)`. This behaviour becomes a problem when the evaluation of one of the arguments produces side effects that other arguments depend on. The following expressions can produce side-effect: state modifying external call , state modifying internal call, `raw_call`, `pop()` when used on a Dynamic Array stored in the storage, `create_minimal_proxy_to`, `create_copy_of`, `create_from_blueprint`. This issue has not yet been patched. Users are advised to make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.

• CWE-670

• https://github.com/vyperlang/vyper/security/advisories/GHSA-g2xh-c426-v8mfExploit, Third Party Advisory
• https://github.com/vyperlang/vyper/security/advisories/GHSA-g2xh-c426-v8mfExploit, Third Party Advisory

Published

Sep 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4001An authentication bypass flaw was found in GRUB due to the w…6.8
• CVE-2023-40010Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-40011Missing Authorization vulnerability in StylemixThemes Cost C…5.4
• CVE-2023-40012uthenticode is a small cross-platform library for partially …7.5
• CVE-2023-40013SVG Loader is a javascript library that fetches SVGs using X…5.4
• CVE-2023-40014OpenZeppelin Contracts is a library for secure smart contrac…5.3
• CVE-2023-40017GeoNode is an open source platform that facilitates the crea…7.5
• CVE-2023-40018FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2023-40019FreeSWITCH is a Software Defined Telecom Stack enabling the …6.5
• CVE-2023-4002An issue has been discovered in GitLab EE affecting all vers…6.5
• CVE-2023-40020PrivateUploader is an open source image hosting server writt…8.3
• CVE-2023-40021Oppia is an online learning platform. When comparing a recei…5.3