Bug 2347042 (CVE-2025-26622) - CVE-2025-26622 vyper: sqrt doesn't define rounding behavior in Vyper
Summary: CVE-2025-26622 vyper: sqrt doesn't define rounding behavior in Vyper
Keywords:
Status: NEW
Alias: CVE-2025-26622
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2347303 2347304
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-02-21 22:01 UTC by OSIDB Bzimport
Modified: 2025-02-24 14:07 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-02-21 22:01:22 UTC 
vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results. This issue is being addressed and a fix is expected in version 0.4.1. Users are advised to upgrade as soon as the patched release is available. There are no known workarounds for this vulnerability.
Note You need to log in before you can comment on or make changes to this bug.