Odaily Planet Daily News The Ethereum programming language Vyper released a post-event analysis report on the vulnerability incident last week. On July 30, multiple Curve liquidity pools were attacked due to a potential vulnerability in the Vyper compiler. The vulnerability itself is an incorrectly implemented re-entry protection. The affected Vype versions are v0.2.15, v0.2.16, v0.3.0.
The vulnerability has been fixed and tested in v0.3.1; v0.3.1 and later are safe. However, the impact on live contracts was not recognized at the time and downstream protocols were not notified.
Vyper said that in the future, stricter two-way feedback using the Vyper protocol will be strengthened, and related bug bounty programs and competitions will be launched. Specific measures include:
- Working with Codehawks to conduct a short competitive audit of the latest version of Vyper.
- Working with Immunefi on a short and long-term bug bounty program for all versions of the Vyper compiler.
- The Vyper Security Alliance, a coordinated multi-protocol bounty program to help discover compiler vulnerabilities in current and older versions that affect Vyper's protected real-time TVL.
- Cooperate with various audit firms such as ChainSecurity, OtterSec, Statemind and Certora to review the old version of Vyper and continue to review the compiler in the future.
- Expanded team size; including a dedicated Security Engineer position aimed at improving Vyper's security tools, both internal and user-facing.
- Collaborate with existing security toolkits provided by Solidity, which will greatly benefit the Vyper ecosystem.
- Design the language specification, which will facilitate formal verification and help test the working of the compiler itself.