CVE-2018-18920: py-evm - Smart Contract Execution Failure
Summary
CVE-2018-18920: Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '"stack": [100, 100, 0]' where b'\x' was expected, resulting in an execution failure because of an i... Affects py-evm versions < 0.2.0a33. Fixed in 0.2.0a33. How to fix ↓
Also tracked for
- evm-py · PyPI
The same CVE-2018-18920 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
py-evm is a Python library that implements the Ethereum Virtual Machine (EVM) for executing smart contracts. It provides developers with the tools to create and interact with Ethereum-compatible blockchain networks. The library allows the execution of smart contracts written in Solidity, the programming language used for Ethereum smart contracts. However, a vulnerability has been discovered in py-evm that can lead to smart contract execution failures and the possibility of indefinite execution without gas being paid.
Vulnerability Detail
The vulnerability (CVE-2018-18920) in py-evm version 0.2.0-alpha.33 arises from a flaw in the vm.execute_bytecode function. Attackers can exploit this vulnerability by making a call to vm.execute_bytecode with a specific input that triggers computation._stack.values with '"stack": [100, 100, 0]' instead of the expected b'\x' values. This results in an execution failure due to an invalid opcode. The vulnerability is related to the ability to execute smart contracts indefinitely without paying gas. If exploited, this vulnerability can disrupt the execution of smart contracts and potentially lead to financial losses or other security issues.
How To Fix
Minimum fixed version
0.2.0a33
This is the first release that contains the fix.
pip install --upgrade "py-evm==0.2.0a33"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of py-evm as soon as possible.
Conclusion
The vulnerability (CVE-2018-18920) in py-evm version 0.2.0-alpha.33 allows attackers to trigger execution failures and potentially execute smart contracts indefinitely without paying gas. Users should upgrade to the fixed version of py-evm to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for py-evm →
FAQ
py-evm is a Python library that implements the Ethereum Virtual Machine (EVM) for executing smart contracts on Ethereum-compatible blockchain networks.
This vulnerability can lead to smart contract execution failures and the possibility of indefinite execution without gas being paid. It can disrupt the execution of smart contracts and potentially result in financial losses or other security issues.
To fix this vulnerability, you should upgrade to py-evm version 0.2.0-alpha.33 or later.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of py-evm.
You can find more information about this vulnerability in the PyPI advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/py-evm/PYSEC-2018-96.yaml
