{"id":"GHSA-7f92-rr6w-cq64","summary":"Storage corruption due to variables overwritten by re-entrancy locks","details":"### Background\nWhen attempting to use the v0.2.14 release, @pandadefi discovered an issue using the `@nonreentrant` decorator.\n\n### Impact\nReentrancy protection storage slots get allocated to the same slots as storage variables, leading to the corruption of storage variables when using the `@nonreentrant` decorator.\n\n### Patches\nThis issue was fixed in v0.2.15 in #2391, #2379\n\n### Workarounds\nDon't use the `@nonreentrant` decorator in these versions.","modified":"2024-12-02T05:40:46.631779Z","published":"2021-08-05T16:57:42Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2021-08-02T19:12:30Z","nvd_published_at":null,"cwe_ids":[],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-7f92-rr6w-cq64"},{"type":"WEB","url":"https://github.com/vyperlang/vyper/pull/2379"},{"type":"WEB","url":"https://github.com/vyperlang/vyper/pull/2391"}],"affected":[{"package":{"name":"vyper","ecosystem":"PyPI","purl":"pkg:pypi/vyper"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.13"},{"fixed":"0.2.15"}]}],"versions":["0.2.13","0.2.14"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-7f92-rr6w-cq64/GHSA-7f92-rr6w-cq64.json"}}],"schema_version":"1.9.0"}