Medium severity · published Apr 25, 2024
CVE-2024-32647
vyper performs double eval of raw_args in create_from_blueprint
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can result in a double eval vulnerability when `raw_args=True` and the `args` argument has side-effects. It can be seen that the `_build_create_IR` function of the `create_from_blueprint` builtin doesn't cache the mentioned `args` argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions exist.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VY
vyper · vyperlang
<= 0.3.10 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32647
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32647
Product
https://github.com/vyperlang/vyper/blob/cedf7087e68e67c7bfbd47ae95dcb16b81ad2e02/vyper/builtins/functions.py#L1847
Vendor Advisory
https://github.com/vyperlang/vyper/security/advisories/GHSA-3whq-64q2-qfj6
More from vyper
9.8
CVE-2024-24563
Vyper array negative index vulnerability
9.8
CVE-2024-24561
Vyper bounds check on built-in `slice()` function can be overflowed
9.8
CVE-2024-22419
concat built-in can corrupt memory in vyper
9.8
CVE-2022-24845
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
9.8
CVE-2022-24788
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
