Skip to content

VVE-2021-0003: Storage variables overwritten by re-entrancy locks

High
fubuloubu published GHSA-7f92-rr6w-cq64 Jul 27, 2021

Package

No package listed

Affected versions

0.2.13,0.2.14

Patched versions

0.2.15

Description

Background

When attempting to use the v0.2.14 release, @pandadefi discovered an issue using the @nonreentrant decorator.

Impact

Reentrancy protection storage slots get allocated to the same slots as storage variables, leading to the corruption of storage variables when using the @nonreentrant decorator.

Patches

This issue was fixed in v0.2.15 in #2391, #2379

Workarounds

Don't use the @nonreentrant decorator in these versions.

References

#2391, #2379

Severity

High

CVE ID

No known CVE

Weaknesses

No CWEs

Credits