CVE-2025-27104: Vyper Vyper Has A Double Eval Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h33q-mhmp-8p67",
  "modified" : "2025-04-09T20:12:39Z",
  "published" : "2025-02-21T22:43:36Z",
  "aliases" : [ "CVE-2025-27104" ],
  "summary" : "Vyper has a double eval in For List Iter",
  "details" : "Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body (e.g. read a storage variable updated in the loop body) and thus lead to unexpected program behavior. Specifically, reads in iterators which contain an ifexp (e.g. `for s: uint256 in ([read(), read()] if True else [])`) may interleave reads with writes in the loop body.\n\nThe fix is tracked in https://github.com/vyperlang/vyper/pull/4488.\n\n### Vulnerability Details\n\nVyper for loops allow two kinds of iterator targets, namely the `range()` builtin and an iterable type, like SArray and DArray. \n\nDuring codegen, iterable lists are required to not produce any side-effects (in the following code, `range_scope` forces `iter_list` to be parsed in a constant context, which is checked against `is_constant`).\n\n```python\ndef _parse_For_list(self):\n    with self.context.range_scope():\n        iter_list = Expr(self.stmt.iter, self.context).ir_node\n    ...\n\ndef range_scope(self):\n    prev_value = self.in_range_expr\n    self.in_range_expr = True\n    yield\n    self.in_range_expr = prev_value\n\ndef is_constant(self):\n    return self.constancy is Constancy.Constant or self.in_range_expr\n```\n\nHowever, this does not prevent the iterator from consuming side effects provided by the body of the loop. For dynamic arrays, the compiler simply panics:\n```vyper\nx: DynArray[uint256, 3]\n\n@external\ndef test():\n    for i: uint256 in (self.usesideeffect() if True else self.usesideeffect()):\n        pass\n\n@view\ndef usesideeffect() -> DynArray[uint256, 3]:\n    return self.x\n```\n\nFor SArrays on the other hand, `iter_list` is instantiated in the body of a `repeat` ir, so it can be evaluated several times.\n\nHere are three illustrating examples. In the first example, the following test case pre-evaluates the iter list and stores the result to a temporary list in memory. So the list is only evaluated once, before entry into the loop body, and the log output will be 0, 0, 0.\n```vyper\nevent I:\n    i: uint256\n\nx: uint256\n\n@deploy\ndef __init__():\n    self.x = 0\n\n@external\ndef test():\n    for i: uint256 in [self.usesideeffect(), self.usesideeffect(), self.usesideeffect()]:\n        self.x += 1\n        log I(i)\n\n@view\ndef usesideeffect() -> uint256:\n    return self.x\n```\n\nHowever, in the next two examples, because the iterator target is not a list literal, it will be evaluated in the loop body. In the second example, `iter_list` is an ifexp, thus it will be evaluated lazily in the loop body. The log output will be 0, 1, 2 due to consumption of side effects.\n\n```vyper\nevent I:\n    i: uint256\n\nx: uint256\n\n@deploy\ndef __init__():\n    self.x = 0\n\n@external\ndef test():\n    for i: uint256 in ([self.usesideeffect(), self.usesideeffect(), self.usesideeffect()] if True else self.otherclause()):\n        self.x += 1\n        log I(i)\n\n@view\ndef usesideeffect() -> uint256:\n    return self.x\n\n@view\ndef otherclause() -> uint256[3]:\n    return [0, 0, 0]\n```\n\nIn the third example, `iter_list` is also an ifexp, thus it will only be evaluated in the loop body. The log output will be 0, 1, 2 due to consumption of side effects.\n\n```vyper\nevent I:\n    i: uint256\n\nx: uint256[3]\n\n@deploy\ndef __init__():\n    self.x = [0, 0, 0]\n\n@external\ndef test():\n    for i: uint256 in (self.usesideeffect() if True else self.otherclause()):\n        self.x[0] += 1\n        self.x[1] += 1\n        self.x[2] += 1\n        log I(i)\n\n@view\ndef usesideeffect() -> uint256[3]:\n    return self.x\n\n@view\ndef otherclause() -> uint256[3]:\n    return [0, 0, 0]\n```",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "vyper"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.4.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.4.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/vyperlang/vyper/security/advisories/GHSA-h33q-mhmp-8p67"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-27104"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vyperlang/vyper/pull/4488"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2025-30.yaml"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/vyperlang/vyper"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-662" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-02-21T22:43:36Z",
    "nvd_published_at" : "2025-02-21T22:15:13Z"
  }
}