Vyper releases compiler vulnerability event analysis report, has fixed the vulnerability and launched a bounty program

Odaily Planet Daily News The Ethereum programming language Vyper released a post-event analysis report on the vulnerability incident last week. On July 30, multiple Curve liquidity pools were attacked due to a potential vulnerability in the Vyper compiler. The vulnerability itself is an incorrectly implemented re-entry protection. The affected Vype versions are v0.2.15, v0.2.16, v0.3.0. The vulnerability has been fixed and tested in v0.3.1; v0.3.1 and later are safe. However, the impact on live contracts was not recognized at the time and downstream protocols were not notified. Vyper said that in the future, stricter two-way feedback using the Vyper protocol will be strengthened, and related bug bounty programs and competitions will be launched. Specific measures include: - Working with Codehawks to conduct a short competitive audit of the latest version of Vyper. - Working with Immunefi on a short and long-term bug bounty program for all versions of the Vyper compiler. - The Vyper Security Alliance, a coordinated multi-protocol bounty program to help discover compiler vulnerabilities in current and older versions that affect Vyper's protected real-time TVL. - Cooperate with various audit firms such as ChainSecurity, OtterSec, Statemind and Certora to review the old version of Vyper and continue to review the compiler in the future. - Expanded team size; including a dedicated Security Engineer position aimed at improving Vyper's security tools, both internal and user-facing. - Collaborate with existing security toolkits provided by Solidity, which will greatly benefit the Vyper ecosystem. - Design the language specification, which will facilitate formal verification and help test the working of the compiler itself.