{
  "schema_version": "1.4.0",
  "id": "GHSA-7f92-rr6w-cq64",
  "modified": "2021-08-02T19:12:30Z",
  "published": "2021-08-05T16:57:42Z",
  "aliases": [],
  "summary": "Storage corruption due to variables overwritten by re-entrancy locks",
  "details": "### Background\nWhen attempting to use the v0.2.14 release, @pandadefi discovered an issue using the `@nonreentrant` decorator.\n\n### Impact\nReentrancy protection storage slots get allocated to the same slots as storage variables, leading to the corruption of storage variables when using the `@nonreentrant` decorator.\n\n### Patches\nThis issue was fixed in v0.2.15 in #2391, #2379\n\n### Workarounds\nDon't use the `@nonreentrant` decorator in these versions.",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vyper"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0.2.13"
            },
            {
              "fixed": "0.2.15"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-7f92-rr6w-cq64"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vyperlang/vyper/pull/2379"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vyperlang/vyper/pull/2391"
    }
  ],
  "database_specific": {
    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-02T19:12:30Z",
    "nvd_published_at": null
  }
}