Vyper versions from 0.2.13 through 0.2.14 allocate storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function decorated with @nonreentrant is executed, the lock value overwrites the overlapping storage variable, corrupting the contract state and breaking the contract's intended logic. This leads to a loss of data integrity and can allow an attacker to manipulate critical state variables, potentially resulting in unauthorized transfers or manipulations of the contract’s behavior. It is an instance of a buffer over-read / out-of-bounds error, classified as CWE-787.

Vyperlang’s Vyper compiler in versions 0.2.13 and 0.2.14 is affected. The vulnerability is fixed in version 0.2.15 and later.

The vulnerability has a CVSS score of 8.3, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through interaction with a deployed contract on a blockchain network, where an attacker can invoke a function covered by the @nonreentrant decorator to trigger the storage overwrite. The exploitation requires the attacker to have the ability to call the affected function; it does not require any privileged access to the compiler or build environment.