CVE-2023-46232

era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype version 1.3.10, a bug prevented the initialization of the first immutable variable for Vyper contracts meeting certain criteria. The problem arises when there is a String or Array with more 256-bit words allocated than initialized. It results in the second word’s index unset, that is effectively set to 0, so the first immutable value with the actual 0 index is overwritten in the ImmutableSimulator. Version 1.3.10 fixes this issue by setting all indexes in advance. The problem will go away, but it will get more expensive if the user allocates a lot of uninitialized space, e.g. `String[4096]`. Upgrading and redeploying affected contracts is the only way of working around the issue.

• CWE-471

• https://github.com/matter-labs/era-compiler-vyper/commit/8be305a1b9c68d0fd47dad3434224ed85944ca25Patch
• https://github.com/matter-labs/era-compiler-vyper/security/advisories/GHSA-h8jv-969m-94r4Exploit, Vendor Advisory
• https://github.com/matter-labs/era-system-contracts/blob/main/contracts/ImmutableSimulator.sol#L37Product
• https://github.com/matter-labs/era-compiler-vyper/commit/8be305a1b9c68d0fd47dad3434224ed85944ca25Patch
• https://github.com/matter-labs/era-compiler-vyper/security/advisories/GHSA-h8jv-969m-94r4Exploit, Vendor Advisory
• https://github.com/matter-labs/era-system-contracts/blob/main/contracts/ImmutableSimulator.sol#L37Product

Published

Oct 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46227 Deserialization of Untrusted Data Vulnerability in Apache S…7.5
• CVE-2023-46228zchunk before 1.3.2 has multiple integer overflows via malfo…7.8
• CVE-2023-46229LangChain before 0.0.317 allows SSRF via document_loaders/re…8.8
• CVE-2023-4623A use-after-free vulnerability in the Linux kernel's net/sch…7.8
• CVE-2023-46230In Splunk Add-on Builder versions below 4.1.4, the app write…4.9
• CVE-2023-46231In Splunk Add-on Builder versions below 4.1.4, the applicati…7.2
• CVE-2023-46233crypto-js is a JavaScript library of crypto standards. Prior…9.1
• CVE-2023-46234browserify-sign is a package to duplicate the functionality …7.5
• CVE-2023-46235FOG is a free open-source cloning/imaging/rescue suite/inven…6.1
• CVE-2023-46236FOG is a free open-source cloning/imaging/rescue suite/inven…7.5
• CVE-2023-46237FOG is a free open-source cloning/imaging/rescue suite/inven…5.3
• CVE-2023-46238ZITADEL is an identity infrastructure management system. ZIT…5.4