Merge branch 'master' into perf/ir-ctor

.github/PULL_REQUEST_TEMPLATE.md

@@ -6,7 +6,7 @@
 
 ### Commit message
 
-Commit message for the final, squashed PR. (Optional, but reviewers will appreciate it! Please see [our commit message style guide](../../blob/master/docs/style-guide.rst#best-practices-1) for what we would ideally like to see in a commit message.)
+Commit message for the final, squashed PR. (Optional, but reviewers will appreciate it! Please see [our commit message style guide](../../master/docs/style-guide.rst#best-practices-1) for what we would ideally like to see in a commit message.)
 
 ### Description for the changelog
 

.github/workflows/test.yml

@@ -104,7 +104,7 @@ jobs:
       run: pip install tox
 
     - name: Run Tox
-      run: TOXENV=py${{ matrix.python-version[1] }} tox -r -- --optimize ${{ matrix.opt-mode }} ${{ matrix.debug && '--enable-compiler-debug-mode' || '' }} --reruns 10 --reruns-delay 1 -r aR tests/
+      run: TOXENV=py${{ matrix.python-version[1] }} tox -r -- --optimize ${{ matrix.opt-mode }} ${{ matrix.debug && '--enable-compiler-debug-mode' || '' }} -r aR tests/
 
     - name: Upload Coverage
       uses: codecov/codecov-action@v1
@@ -148,12 +148,12 @@ jobs:
 
     # fetch test durations
     # NOTE: if the tests get poorly distributed, run this and commit the resulting `.test_durations` file to the `vyper-test-durations` repo.
-    # `TOXENV=fuzzing tox -r -- --store-durations --reruns 10 --reruns-delay 1 -r aR tests/`
+    # `TOXENV=fuzzing tox -r -- --store-durations -r aR tests/`
     - name: Fetch test-durations
       run: curl --location "https://raw.githubusercontent.com/vyperlang/vyper-test-durations/5982755ee8459f771f2e8622427c36494646e1dd/test_durations" -o .test_durations
 
     - name: Run Tox
-      run: TOXENV=fuzzing tox -r -- --splits 60 --group ${{ matrix.group }} --splitting-algorithm least_duration --reruns 10 --reruns-delay 1 -r aR tests/
+      run: TOXENV=fuzzing tox -r -- --splits 60 --group ${{ matrix.group }} --splitting-algorithm least_duration -r aR tests/
 
     - name: Upload Coverage
       uses: codecov/codecov-action@v1

FUNDING.yml

@@ -1 +1 @@
-custom: https://gitcoin.co/grants/200/vyper-smart-contract-language-2
+custom: https://etherscan.io/address/0x70CCBE10F980d80b7eBaab7D2E3A73e87D67B775

SECURITY.md

@@ -48,7 +48,7 @@ https://github.com/vyperlang/vyper/security/advisories
 
 If you think you have found a security vulnerability with a project that has used Vyper,
 please report the vulnerability to the relevant project's security disclosure program prior
-to reporting to us. If one is not available, please email your vulnerability to [email protected].
+to reporting to us. If one is not available, submit it at https://github.com/vyperlang/vyper/security/advisories.
 
 **Please Do Not Log An Issue** mentioning the vulnerability.
 

docs/built-in-functions.rst

@@ -184,13 +184,14 @@ Vyper has three built-ins for contract creation; all three contract creation bui
     The implementation of ``create_copy_of`` assumes that the code at ``target`` is smaller than 16MB. While this is much larger than the EIP-170 constraint of 24KB, it is a conservative size limit intended to future-proof deployer contracts in case the EIP-170 constraint is lifted. If the code at ``target`` is larger than 16MB, the behavior of ``create_copy_of`` is undefined.
 
 
-.. py:function:: create_from_blueprint(target: address, *args, value: uint256 = 0, code_offset=0, [, salt: bytes32]) -> address
+.. py:function:: create_from_blueprint(target: address, *args, value: uint256 = 0, raw_args: bool = False, code_offset: int = 0, [, salt: bytes32]) -> address
 
     Copy the code of ``target`` into memory and execute it as initcode. In other words, this operation interprets the code at ``target`` not as regular runtime code, but directly as initcode. The ``*args`` are interpreted as constructor arguments, and are ABI-encoded and included when executing the initcode.
 
     * ``target``: Address of the blueprint to invoke
     * ``*args``: Constructor arguments to forward to the initcode.
     * ``value``: The wei value to send to the new contract address (Optional, default 0)
+    * ``raw_args``: If ``True``, ``*args`` must be a single ``Bytes[...]`` argument, which will be interpreted as a raw bytes buffer to forward to the create operation (which is useful for instance, if pre- ABI-encoded data is passed in from elsewhere). (Optional, default ``False``)
     * ``code_offset``: The offset to start the ``EXTCODECOPY`` from (Optional, default 0)
     * ``salt``: A ``bytes32`` value utilized by the deterministic ``CREATE2`` opcode (Optional, if not supplied, ``CREATE`` is used)
 
@@ -201,7 +202,7 @@ Vyper has three built-ins for contract creation; all three contract creation bui
         @external
         def foo(blueprint: address) -> address:
             arg1: uint256 = 18
-            arg2: String = "some string"
+            arg2: String[32] = "some string"
             return create_from_blueprint(blueprint, arg1, arg2, code_offset=1)
 
 .. note::
@@ -226,7 +227,7 @@ Vyper has three built-ins for contract creation; all three contract creation bui
     * ``to``: Destination address to call to
     * ``data``: Data to send to the destination address
     * ``max_outsize``: Maximum length of the bytes array returned from the call. If the returned call data exceeds this length, only this number of bytes is returned. (Optional, default ``0``)
-    * ``gas``: The amount of gas to attach to the call. If not set, all remaining gas is forwarded.
+    * ``gas``: The amount of gas to attach to the call. (Optional, defaults to ``msg.gas``).
     * ``value``: The wei value to send to the address (Optional, default ``0``)
     * ``is_delegate_call``: If ``True``, the call will be sent as ``DELEGATECALL`` (Optional, default ``False``)
     * ``is_static_call``: If ``True``, the call will be sent as ``STATICCALL`` (Optional, default ``False``)
@@ -264,6 +265,10 @@ Vyper has three built-ins for contract creation; all three contract creation bui
             assert success
             return response
 
+    .. note::
+
+        Regarding "forwarding all gas", note that, while Vyper will provide ``msg.gas`` to the call, in practice, there are some subtleties around forwarding all remaining gas on the EVM which are out of scope of this documentation and could be subject to change. For instance, see the language in EIP-150 around "all but one 64th".
+
 .. py:function:: raw_log(topics: bytes32[4], data: Union[Bytes, bytes32]) -> None
 
     Provides low level access to the ``LOG`` opcodes, emitting a log without having to specify an ABI type.
@@ -500,7 +505,7 @@ Data Manipulation
 
     * ``b``: ``Bytes`` list to extract from
     * ``start``: Start point to extract from
-    * ``output_type``: Type of output (``bytes32``, ``integer``, or ``address``). Defaults to ``bytes32``.
+    * ``output_type``: Type of output (``bytesM``, ``integer``, or ``address``). Defaults to ``bytes32``.
 
     Returns a value of the type specified by ``output_type``.
 

docs/compiling-a-contract.rst

@@ -197,6 +197,7 @@ The following is a list of supported EVM versions, and changes in the compiler i
 
    - The ``transient`` keyword allows declaration of variables which live in transient storage
    - Functions marked with ``@nonreentrant`` are protected with TLOAD/TSTORE instead of SLOAD/SSTORE
+   - The ``MCOPY`` opcode will be generated automatically by the compiler for most memory operations.
 
 
 

docs/control-structures.rst

@@ -271,16 +271,25 @@ Ranges are created using the ``range`` function. The following examples are vali
 
 ``STOP`` is a literal integer greater than zero. ``i`` begins as zero and increments by one until it is equal to ``STOP``.
 
+.. code-block:: python
+
+    for i in range(stop, bound=N):
+        ...
+
+Here, ``stop`` can be a variable with integer type, greater than zero. ``N`` must be a compile-time constant. ``i`` begins as zero and increments by one until it is equal to ``stop``. If ``stop`` is larger than ``N``, execution will revert at runtime. In certain cases, you may not have a guarantee that ``stop`` is less than ``N``, but still want to avoid the possibility of runtime reversion. To accomplish this, use the ``bound=`` keyword in combination with ``min(stop, N)`` as the argument to ``range``, like ``range(min(stop, N), bound=N)``. This is helpful for use cases like chunking up operations on larger arrays across multiple transactions.
+
+Another use of range can be with ``START`` and ``STOP`` bounds.
+
 .. code-block:: python
 
     for i in range(START, STOP):
         ...
 
-``START`` and ``STOP`` are literal integers, with ``STOP`` being a greater value than ``START``. ``i`` begins as ``START`` and increments by one until it is equal to ``STOP``.
+Here, ``START`` and ``STOP`` are literal integers, with ``STOP`` being a greater value than ``START``. ``i`` begins as ``START`` and increments by one until it is equal to ``STOP``.
 
 .. code-block:: python
 
     for i in range(a, a + N):
         ...
 
-``a`` is a variable with an integer type and ``N`` is a literal integer greater than zero.  ``i`` begins as ``a`` and increments by one until it is equal to ``a + N``.
+``a`` is a variable with an integer type and ``N`` is a literal integer greater than zero.  ``i`` begins as ``a`` and increments by one until it is equal to ``a + N``. If ``a + N`` would overflow, execution will revert.

docs/release-notes.rst

@@ -14,24 +14,21 @@ Release Notes
     for advisory links:
     :'<,'>s/\v(https:\/\/github.com\/vyperlang\/vyper\/security\/advisories\/)([-A-Za-z0-9]+)/(`\2 <\1\2>`_)/g
 
-..
-    v0.3.10 ("Black Adder")
-    ***********************
-
-v0.3.10rc1
-**********
+v0.3.10 ("Black Adder")
+***********************
 
-Date released: 2023-09-06
+Date released: 2023-10-04
 =========================
 
-v0.3.10 is a performance focused release. It adds a ``codesize`` optimization mode (`#3493 <https://github.com/vyperlang/vyper/pull/3493>`_), adds new vyper-specific ``#pragma`` directives  (`#3493 <https://github.com/vyperlang/vyper/pull/3493>`_), uses Cancun's ``MCOPY`` opcode for some compiler generated code (`#3483 <https://github.com/vyperlang/vyper/pull/3483>`_), and generates selector tables which now feature O(1) performance (`#3496 <https://github.com/vyperlang/vyper/pull/3496>`_).
+v0.3.10 is a performance focused release that additionally ships numerous bugfixes. It adds a ``codesize`` optimization mode (`#3493 <https://github.com/vyperlang/vyper/pull/3493>`_), adds new vyper-specific ``#pragma`` directives  (`#3493 <https://github.com/vyperlang/vyper/pull/3493>`_), uses Cancun's ``MCOPY`` opcode for some compiler generated code (`#3483 <https://github.com/vyperlang/vyper/pull/3483>`_), and generates selector tables which now feature O(1) performance (`#3496 <https://github.com/vyperlang/vyper/pull/3496>`_).
 
 Breaking changes:
 -----------------
 
 - add runtime code layout to initcode (`#3584 <https://github.com/vyperlang/vyper/pull/3584>`_)
 - drop evm versions through istanbul (`#3470 <https://github.com/vyperlang/vyper/pull/3470>`_)
 - remove vyper signature from runtime (`#3471 <https://github.com/vyperlang/vyper/pull/3471>`_)
+- only allow valid identifiers to be nonreentrant keys (`#3605 <https://github.com/vyperlang/vyper/pull/3605>`_)
 
 Non-breaking changes and improvements:
 --------------------------------------
@@ -46,12 +43,15 @@ Notable fixes:
 
 - fix ``ecrecover()`` behavior when signature is invalid (`GHSA-f5x6-7qgp-jhf3 <https://github.com/vyperlang/vyper/security/advisories/GHSA-f5x6-7qgp-jhf3>`_, `#3586 <https://github.com/vyperlang/vyper/pull/3586>`_)
 - fix: order of evaluation for some builtins (`#3583 <https://github.com/vyperlang/vyper/pull/3583>`_, `#3587 <https://github.com/vyperlang/vyper/pull/3587>`_)
+- fix: memory allocation in certain builtins using ``msize`` (`#3610 <https://github.com/vyperlang/vyper/pull/3610>`_)
+- fix: ``_abi_decode()`` input validation in certain complex expressions (`#3626 <https://github.com/vyperlang/vyper/pull/3626>`_)
 - fix: pycryptodome for arm builds (`#3485 <https://github.com/vyperlang/vyper/pull/3485>`_)
 - let params of internal functions be mutable (`#3473 <https://github.com/vyperlang/vyper/pull/3473>`_)
 - typechecking of folded builtins in (`#3490 <https://github.com/vyperlang/vyper/pull/3490>`_)
 - update tload/tstore opcodes per latest 1153 EIP spec (`#3484 <https://github.com/vyperlang/vyper/pull/3484>`_)
 - fix: raw_call type when max_outsize=0 is set (`#3572 <https://github.com/vyperlang/vyper/pull/3572>`_)
 - fix: implements check for indexed event arguments (`#3570 <https://github.com/vyperlang/vyper/pull/3570>`_)
+- fix: type-checking for ``_abi_decode()`` arguments (`#3626 <https://github.com/vyperlang/vyper/pull/3623>`_)
 
 Other docs updates, chores and fixes:
 -------------------------------------

docs/resources.rst

@@ -3,45 +3,47 @@
 Other resources and learning material
 #####################################
 
-Vyper has an active community. You can find third party tutorials,
-examples, courses and other learning material.
+Vyper has an active community. You can find third-party tutorials, examples, courses, and other learning material.
 
 General
 -------
 
-- `Ape Academy - Learn how to build vyper projects <https://academy.apeworx.io/>`__ by ApeWorX
-- `More Vyper by Example <https://vyper-by-example.org/>`__ by Smart Contract Engineer
-- `Vyper cheat Sheet <https://reference.auditless.com/cheatsheet>`__
-- `Vyper Hub for development <https://github.com/zcor/vyper-dev>`__
-- `Vyper greatest hits smart contract examples <https://github.com/pynchmeister/vyper-greatest-hits/tree/main/contracts>`__
+- `Ape Academy – Learn how to build Vyper projects <https://academy.apeworx.io/>`_ by ApeWorX
+- `More Vyper by Example <https://vyper-by-example.org/>`_ by Smart Contract Engineer
+- `Vyper cheat Sheet <https://reference.auditless.com/cheatsheet>`_
+- `Vyper Hub for development <https://github.com/zcor/vyper-dev>`_
+- `Vyper greatest hits smart contract examples <https://github.com/pynchmeister/vyper-greatest-hits/tree/main/contracts>`_
+- `A curated list of Vyper resources, libraries, tools, and more <https://github.com/stars/pcaversaccio/lists/vyper>`_
 
 Frameworks and tooling
 ----------------------
 
-- `ApeWorX - The Ethereum development framework for Python Developers, Data Scientists, and Security Professionals <https://www.apeworx.io/>`__
-- `Foundry x Vyper - Foundry template to compile Vyper contracts <https://github.com/0xKitsune/Foundry-Vyper>`__
-- `Snekmate - Vyper smart contract building blocks <https://github.com/pcaversaccio/snekmate>`__
-- `Serpentor - A set of smart contracts tools for governance <https://github.com/yearn/serpentor>`__
-- `Smart contract development frameworks and tools for Vyper on Ethreum.org <https://ethereum.org/en/developers/docs/programming-languages/python/>`__
+- `Titanoboa – An experimental Vyper interpreter with pretty tracebacks, forking, debugging features and more <https://github.com/vyperlang/titanoboa/>`_
+- `ApeWorX – The Ethereum development framework for Python Developers, Data Scientists, and Security Professionals <https://www.apeworx.io/>`_
+- `VyperDeployer – A helper smart contract to compile and test Vyper contracts in Foundry <https://github.com/pcaversaccio/snekmate/blob/main/lib/utils/VyperDeployer.sol>`_
+- `🐍 snekmate – Vyper smart contract building blocks <https://github.com/pcaversaccio/snekmate>`_
+- `Serpentor – A set of smart contracts tools for governance <https://github.com/yearn/serpentor>`_
+- `Smart contract development frameworks and tools for Vyper on Ethreum.org <https://ethereum.org/en/developers/docs/programming-languages/python/>`_
 
 Security
 --------
 
-- `VyperPunk - learn to secure and hack Vyper smart contracts <https://github.com/SupremacyTeam/VyperPunk>`__
-- `VyperExamples - Vyper vulnerability examples <https://www.vyperexamples.com/reentrancy>`__
+- `VyperPunk – learn to secure and hack Vyper smart contracts <https://github.com/SupremacyTeam/VyperPunk>`_
+- `VyperExamples – Vyper vulnerability examples <https://www.vyperexamples.com/reentrancy>`_
 
 Conference presentations
 ------------------------
 
-- `Vyper Smart Contract Programming Language by Patrick Collins (2022, 30 mins) <https://www.youtube.com/watch?v=b-sOMNF9quo&t=1444s>`__
-- `Python and DeFi by Curve Finance (2022, 15 mins) <https://www.youtube.com/watch?v=4HOU3z0LoDg>`__
-- `My experience with Vyper over the years by Benjamin Scherrey (2022, 15 mins) <https://www.youtube.com/watch?v=_j7qF_GlyWE>`__
-- `Short introduction to Vyper by Edison Que (3 mins) <https://www.youtube.com/watch?v=dXqln-keyHw&t=4s>`__
+- `Vyper Smart Contract Programming Language by Patrick Collins (2022, 30 mins) <https://www.youtube.com/watch?v=b-sOMNF9quo&t=1444s>`_
+- `Python and DeFi by Curve Finance (2022, 15 mins) <https://www.youtube.com/watch?v=4HOU3z0LoDg>`_
+- `My experience with Vyper over the years by Benjamin Scherrey (2022, 15 mins) <https://www.youtube.com/watch?v=_j7qF_GlyWE>`_
+- `Short introduction to Vyper by Edison Que (3 mins) <https://www.youtube.com/watch?v=dXqln-keyHw&t=4s>`_
 
 Unmaintained
 ------------
 
 These resources have not been updated for a while, but may still offer interesting content.
 
-- `Awesome Vyper curated resources <https://github.com/spadebuilders/awesome-vyper>`__
-- `Brownie - Python framework for developing smart contracts (deprecated) <https://eth-brownie.readthedocs.io/en/stable/>`__
+- `Awesome Vyper curated resources <https://github.com/spadebuilders/awesome-vyper>`_
+- `Brownie – Python framework for developing smart contracts (deprecated) <https://eth-brownie.readthedocs.io/en/stable/>`_
+- `Foundry x Vyper – Foundry template to compile Vyper contracts <https://github.com/0xKitsune/Foundry-Vyper>`_

docs/structure-of-a-contract.rst

@@ -17,14 +17,18 @@ Vyper supports several source code directives to control compiler modes and help
 Version Pragma
 --------------
 
-The version pragma ensures that a contract is only compiled by the intended compiler version, or range of versions. Version strings use `NPM <https://docs.npmjs.com/about-semantic-versioning>`_ style syntax. Starting from v0.4.0 and up, version strings will use `PEP440 version specifiers <https://peps.python.org/pep-0440/#version-specifiers>_`.
+The version pragma ensures that a contract is only compiled by the intended compiler version, or range of versions. Version strings use `NPM <https://docs.npmjs.com/about-semantic-versioning>`_ style syntax. Starting from v0.4.0 and up, version strings will use `PEP440 version specifiers <https://peps.python.org/pep-0440/#version-specifiers>`_.
 
 As of 0.3.10, the recommended way to specify the version pragma is as follows:
 
 .. code-block:: python
 
     #pragma version ^0.3.0
 
+.. note::
+
+    Both pragma directive versions ``#pragma`` and ``# pragma`` are supported.
+
 The following declaration is equivalent, and, prior to 0.3.10, was the only supported method to specify the compiler version:
 
 .. code-block:: python

examples/crowdfund.vy

@@ -18,15 +18,15 @@ def __init__(_beneficiary: address, _goal: uint256, _timelimit: uint256):
 @external
 @payable
 def participate():
-    assert block.timestamp < self.deadline, "deadline not met (yet)"
+    assert block.timestamp < self.deadline, "deadline has expired"
 
     self.funders[msg.sender] += msg.value
 
 # Enough money was raised! Send funds to the beneficiary
 @external
 def finalize():
-    assert block.timestamp >= self.deadline, "deadline has passed"
-    assert self.balance >= self.goal, "the goal has not been reached"
+    assert block.timestamp >= self.deadline, "deadline has not expired yet"
+    assert self.balance >= self.goal, "goal has not been reached"
 
     selfdestruct(self.beneficiary)