{"id":"GHSA-375m-5fvv-xq23","aliases":[],"url":"https://o3.security/vulnerability/GHSA-375m-5fvv-xq23","summary":"VVE-2021-0002: Incorrect `returndatasize` when using simple forwarder proxies deployed prior to EIP-1167 adoption","details":"## Background\n\n@tjayrush reported a data handling issue with certain Web3 libraries using Vyper-deploy forwarder proxy contracts using our Vyper's built-in `create_forwarder_to` function prior to our change to support EIP-1167 style forwarder proxies.\n\n### Impact\nIf you are an end user of a forwarder-style proxy deployed using Vyper's built-in `create_forwarder_to` function AND you have a function that returns >4096 bytes AND you do no return data sanitation on the value returned, you could potentially see a data corruption issue.\n\nOtherwise, if you are handling the result of a return call AND you expect a specific `RETURNDATASIZE` that is less than 4096 (such as `SafeERC20.safeTransfer`) then the call will fail that check.\n\n### Patches\nThe issue was patched when we upgraded to EIP-1167 style forwarder proxies in #2281.\n\n### Workarounds\nIf you are making a call to a contract method that is expected to return <= 4096 bytes, there is no issue as the ABI decoders in both Solidity and Vyper will truncate the data properly. Web3 libraries will also do this, unless you are doing `eth_call` or `eth_sendTransaction` directly.\n\nIf you are using a Solidity library that checks `RETURNDATASIZE` of an external call to a forwarder proxy deployed prior to this patch, it will fail on that assertion (such as `SafeERC20.safeTransfer`). The workaround is to always do a greater than or equal to check, rather than a strict equals to check.","published":"2021-04-19T15:11:54Z","modified":"2024-12-02T05:51:13.220757Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"vyper","fixedVersion":"0.2.9"}],"fix":{"url":"https://github.com/vyperlang/vyper/pull/2281","label":"vyperlang/vyper#2281"},"references":[{"type":"WEB","url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23"},{"type":"WEB","url":"https://github.com/vyperlang/vyper/pull/2281"},{"type":"WEB","url":"https://pypi.org/project/vyper"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-02T05:51:13.220757Z"}}