HIGH

GHSA-7f92-rr6w-cq64

Storage corruption due to variables overwritten by re-entrancy locks

Details

### Background When attempting to use the v0.2.14 release, @pandadefi discovered an issue using the `@nonreentrant` decorator.

### Impact Reentrancy protection storage slots get allocated to the same slots as storage variables, leading to the corruption of storage variables when using the `@nonreentrant` decorator.

### Patches This issue was fixed in v0.2.15 in #2391, #2379

### Workarounds Don't use the `@nonreentrant` decorator in these versions.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / vyper

Introduced in: 0.2.13 Fixed in: 0.2.15

Fix pip install --upgrade 'vyper>=0.2.15'

References

https://github.com/vyperlang/vyper/security/advisories/GHSA-7f92-rr6w-cq64 [WEB]
https://github.com/vyperlang/vyper/pull/2379 [WEB]
https://github.com/vyperlang/vyper/pull/2391 [WEB]